# Flog Txt Version 1 # Analyzer Version: 2.3.2 # Analyzer Build Date: Nov 9 2018 10:32:43 # Log Creation Date: 17.11.2018 23:01:34.892 Process: id = "1" image_name = "tron.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tron.exe" page_root = "0x5180e000" os_pid = "0x328" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ea88" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Region: id = 1 start_va = 0x10000 end_va = 0x2ffff entry_point = 0x0 region_type = private name = "private_0x0000000000010000" filename = "" Region: id = 2 start_va = 0x30000 end_va = 0x33fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000030000" filename = "" Region: id = 3 start_va = 0x40000 end_va = 0x4dfff entry_point = 0x40000 region_type = mapped_file name = "tron.exe" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tron.exe") Region: id = 4 start_va = 0x50000 end_va = 0x50fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000050000" filename = "" Region: id = 5 start_va = 0x1f0000 end_va = 0x2effff entry_point = 0x0 region_type = private name = "private_0x00000000001f0000" filename = "" Region: id = 6 start_va = 0x77670000 end_va = 0x77818fff entry_point = 0x77670000 region_type = mapped_file name = "ntdll.dll" filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll") Region: id = 7 start_va = 0x7efe0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007efe0000" filename = "" Region: id = 8 start_va = 0x7ffe0000 end_va = 0x7ffeffff entry_point = 0x0 region_type = private name = "private_0x000000007ffe0000" filename = "" Region: id = 9 start_va = 0x7feff990000 end_va = 0x7feff990fff entry_point = 0x7feff990000 region_type = mapped_file name = "apisetschema.dll" filename = "\\Windows\\System32\\apisetschema.dll" (normalized: "c:\\windows\\system32\\apisetschema.dll") Region: id = 10 start_va = 0x7fffffb0000 end_va = 0x7fffffd2fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000007fffffb0000" filename = "" Region: id = 11 start_va = 0x7fffffd7000 end_va = 0x7fffffd7fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd7000" filename = "" Region: id = 12 start_va = 0x7fffffde000 end_va = 0x7fffffdffff entry_point = 0x0 region_type = private name = "private_0x000007fffffde000" filename = "" Region: id = 145 start_va = 0x460000 end_va = 0x4dffff entry_point = 0x0 region_type = private name = "private_0x0000000000460000" filename = "" Region: id = 146 start_va = 0x77550000 end_va = 0x7766efff entry_point = 0x77550000 region_type = mapped_file name = "kernel32.dll" filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll") Region: id = 147 start_va = 0x7fef44f0000 end_va = 0x7fef455efff entry_point = 0x7fef44f0000 region_type = mapped_file name = "mscoree.dll" filename = "\\Windows\\System32\\mscoree.dll" (normalized: "c:\\windows\\system32\\mscoree.dll") Region: id = 148 start_va = 0x7fefd920000 end_va = 0x7fefd98afff entry_point = 0x7fefd920000 region_type = mapped_file name = "kernelbase.dll" filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll") Region: id = 149 start_va = 0x10000 end_va = 0x1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000010000" filename = "" Region: id = 150 start_va = 0x60000 end_va = 0xc6fff entry_point = 0x60000 region_type = mapped_file name = "locale.nls" filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls") Region: id = 151 start_va = 0xd0000 end_va = 0x1cffff entry_point = 0x0 region_type = private name = "private_0x00000000000d0000" filename = "" Region: id = 152 start_va = 0x3c0000 end_va = 0x43ffff entry_point = 0x0 region_type = private name = "private_0x00000000003c0000" filename = "" Region: id = 153 start_va = 0x690000 end_va = 0x69ffff entry_point = 0x0 region_type = private name = "private_0x0000000000690000" filename = "" Region: id = 154 start_va = 0x7efe0000 end_va = 0x7f0dffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000007efe0000" filename = "" Region: id = 155 start_va = 0x7f0e0000 end_va = 0x7ffdffff entry_point = 0x0 region_type = private name = "private_0x000000007f0e0000" filename = "" Region: id = 156 start_va = 0x7fefdb10000 end_va = 0x7fefdbaefff entry_point = 0x7fefdb10000 region_type = mapped_file name = "msvcrt.dll" filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll") Region: id = 157 start_va = 0x7fefe330000 end_va = 0x7fefe34efff entry_point = 0x7fefe330000 region_type = mapped_file name = "sechost.dll" filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll") Region: id = 158 start_va = 0x7feff740000 end_va = 0x7feff81afff entry_point = 0x7feff740000 region_type = mapped_file name = "advapi32.dll" filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll") Region: id = 159 start_va = 0x7feff820000 end_va = 0x7feff94cfff entry_point = 0x7feff820000 region_type = mapped_file name = "rpcrt4.dll" filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll") Region: id = 160 start_va = 0x4e0000 end_va = 0x5dffff entry_point = 0x0 region_type = private name = "private_0x00000000004e0000" filename = "" Region: id = 161 start_va = 0x880000 end_va = 0x88ffff entry_point = 0x0 region_type = private name = "private_0x0000000000880000" filename = "" Region: id = 162 start_va = 0x7fef43a0000 end_va = 0x7fef4438fff entry_point = 0x7fef43a0000 region_type = mapped_file name = "mscoreei.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscoreei.dll") Region: id = 163 start_va = 0x77450000 end_va = 0x77549fff entry_point = 0x77450000 region_type = mapped_file name = "user32.dll" filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll") Region: id = 164 start_va = 0x7fefdc90000 end_va = 0x7fefdcf6fff entry_point = 0x7fefdc90000 region_type = mapped_file name = "gdi32.dll" filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll") Region: id = 165 start_va = 0x7fefdd00000 end_va = 0x7fefddc8fff entry_point = 0x7fefdd00000 region_type = mapped_file name = "usp10.dll" filename = "\\Windows\\System32\\usp10.dll" (normalized: "c:\\windows\\system32\\usp10.dll") Region: id = 166 start_va = 0x7fefe350000 end_va = 0x7fefe35dfff entry_point = 0x7fefe350000 region_type = mapped_file name = "lpk.dll" filename = "\\Windows\\System32\\lpk.dll" (normalized: "c:\\windows\\system32\\lpk.dll") Region: id = 167 start_va = 0x7feff2e0000 end_va = 0x7feff350fff entry_point = 0x7feff2e0000 region_type = mapped_file name = "shlwapi.dll" filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll") Region: id = 168 start_va = 0x6a0000 end_va = 0x827fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000006a0000" filename = "" Region: id = 169 start_va = 0x7fefe0a0000 end_va = 0x7fefe1a8fff entry_point = 0x7fefe0a0000 region_type = mapped_file name = "msctf.dll" filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll") Region: id = 170 start_va = 0x7feff950000 end_va = 0x7feff97dfff entry_point = 0x7feff950000 region_type = mapped_file name = "imm32.dll" filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll") Region: id = 171 start_va = 0x20000 end_va = 0x20fff entry_point = 0x0 region_type = private name = "private_0x0000000000020000" filename = "" Region: id = 172 start_va = 0x1d0000 end_va = 0x1d0fff entry_point = 0x0 region_type = private name = "private_0x00000000001d0000" filename = "" Region: id = 173 start_va = 0x890000 end_va = 0xa10fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000890000" filename = "" Region: id = 174 start_va = 0xa20000 end_va = 0x1e1ffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000a20000" filename = "" Region: id = 175 start_va = 0x7fefc780000 end_va = 0x7fefc78bfff entry_point = 0x7fefc780000 region_type = mapped_file name = "version.dll" filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll") Region: id = 176 start_va = 0x7fef3890000 end_va = 0x7fef4216fff entry_point = 0x7fef3890000 region_type = mapped_file name = "clr.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clr.dll") Region: id = 177 start_va = 0x7fef42a0000 end_va = 0x7fef4396fff entry_point = 0x7fef42a0000 region_type = mapped_file name = "msvcr120_clr0400.dll" filename = "\\Windows\\System32\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\system32\\msvcr120_clr0400.dll") Region: id = 178 start_va = 0x1e0000 end_va = 0x1e0fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000001e0000" filename = "" Region: id = 179 start_va = 0x2f0000 end_va = 0x2fffff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x00000000002f0000" filename = "" Region: id = 180 start_va = 0x300000 end_va = 0x30ffff entry_point = 0x0 region_type = private name = "private_0x0000000000300000" filename = "" Region: id = 181 start_va = 0x310000 end_va = 0x310fff entry_point = 0x0 region_type = private name = "private_0x0000000000310000" filename = "" Region: id = 182 start_va = 0x320000 end_va = 0x320fff entry_point = 0x0 region_type = private name = "private_0x0000000000320000" filename = "" Region: id = 183 start_va = 0x1e20000 end_va = 0x1f1ffff entry_point = 0x0 region_type = private name = "private_0x0000000001e20000" filename = "" Region: id = 184 start_va = 0x1f20000 end_va = 0x1f9ffff entry_point = 0x0 region_type = private name = "private_0x0000000001f20000" filename = "" Region: id = 185 start_va = 0x2050000 end_va = 0x214ffff entry_point = 0x0 region_type = private name = "private_0x0000000002050000" filename = "" Region: id = 186 start_va = 0x2180000 end_va = 0x21fffff entry_point = 0x0 region_type = private name = "private_0x0000000002180000" filename = "" Region: id = 187 start_va = 0x2200000 end_va = 0x1a1fffff entry_point = 0x0 region_type = private name = "private_0x0000000002200000" filename = "" Region: id = 188 start_va = 0x1a200000 end_va = 0x1a56ffff entry_point = 0x0 region_type = private name = "private_0x000000001a200000" filename = "" Region: id = 189 start_va = 0x1a570000 end_va = 0x1a670fff entry_point = 0x0 region_type = private name = "private_0x000000001a570000" filename = "" Region: id = 190 start_va = 0x1a790000 end_va = 0x1a88ffff entry_point = 0x0 region_type = private name = "private_0x000000001a790000" filename = "" Region: id = 191 start_va = 0x1a8c0000 end_va = 0x1a9bffff entry_point = 0x0 region_type = private name = "private_0x000000001a8c0000" filename = "" Region: id = 192 start_va = 0x1a9c0000 end_va = 0x1ac8efff entry_point = 0x1a9c0000 region_type = mapped_file name = "sortdefault.nls" filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls") Region: id = 193 start_va = 0x7fe94110000 end_va = 0x7fe9411ffff entry_point = 0x0 region_type = private name = "private_0x000007fe94110000" filename = "" Region: id = 194 start_va = 0x7fe94120000 end_va = 0x7fe9412ffff entry_point = 0x0 region_type = private name = "private_0x000007fe94120000" filename = "" Region: id = 195 start_va = 0x7fe94130000 end_va = 0x7fe941bffff entry_point = 0x0 region_type = private name = "private_0x000007fe94130000" filename = "" Region: id = 196 start_va = 0x7fe941c0000 end_va = 0x7fe9422ffff entry_point = 0x0 region_type = private name = "private_0x000007fe941c0000" filename = "" Region: id = 197 start_va = 0x7fef23c0000 end_va = 0x7fef3888fff entry_point = 0x7fef23c0000 region_type = mapped_file name = "mscorlib.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\70690ed034c632a010f791ea65e40064\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\mscorlib\\70690ed034c632a010f791ea65e40064\\mscorlib.ni.dll") Region: id = 198 start_va = 0x7fefddf0000 end_va = 0x7fefdff2fff entry_point = 0x7fefddf0000 region_type = mapped_file name = "ole32.dll" filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll") Region: id = 199 start_va = 0x7fffffd8000 end_va = 0x7fffffd9fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd8000" filename = "" Region: id = 200 start_va = 0x7fffffda000 end_va = 0x7fffffdbfff entry_point = 0x0 region_type = private name = "private_0x000007fffffda000" filename = "" Region: id = 201 start_va = 0x7fffffdc000 end_va = 0x7fffffddfff entry_point = 0x0 region_type = private name = "private_0x000007fffffdc000" filename = "" Region: id = 202 start_va = 0x330000 end_va = 0x3acfff entry_point = 0x330000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 203 start_va = 0x330000 end_va = 0x3acfff entry_point = 0x330000 region_type = mapped_file name = "rpcss.dll" filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll") Region: id = 204 start_va = 0x7fefd4b0000 end_va = 0x7fefd4befff entry_point = 0x7fefd4b0000 region_type = mapped_file name = "cryptbase.dll" filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll") Region: id = 205 start_va = 0x7fefbf10000 end_va = 0x7fefbf65fff entry_point = 0x7fefbf10000 region_type = mapped_file name = "uxtheme.dll" filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll") Region: id = 206 start_va = 0x1ac90000 end_va = 0x1ae5ffff entry_point = 0x0 region_type = private name = "private_0x000000001ac90000" filename = "" Region: id = 207 start_va = 0x1a680000 end_va = 0x1a75efff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001a680000" filename = "" Region: id = 208 start_va = 0x7fe94230000 end_va = 0x7fe9426ffff entry_point = 0x0 region_type = private name = "private_0x000007fe94230000" filename = "" Region: id = 209 start_va = 0x7fe94270000 end_va = 0x7fe9427ffff entry_point = 0x0 region_type = private name = "private_0x000007fe94270000" filename = "" Region: id = 210 start_va = 0x7fffff00000 end_va = 0x7fffff0ffff entry_point = 0x0 region_type = private name = "private_0x000007fffff00000" filename = "" Region: id = 211 start_va = 0x7fffff10000 end_va = 0x7fffffaffff entry_point = 0x0 region_type = private name = "private_0x000007fffff10000" filename = "" Region: id = 212 start_va = 0x7fef22b0000 end_va = 0x7fef23b7fff entry_point = 0x7fef22b0000 region_type = mapped_file name = "clrjit.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\clrjit.dll") Region: id = 213 start_va = 0x7fefdbb0000 end_va = 0x7fefdc86fff entry_point = 0x7fefdbb0000 region_type = mapped_file name = "oleaut32.dll" filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll") Region: id = 214 start_va = 0x330000 end_va = 0x33ffff entry_point = 0x0 region_type = private name = "private_0x0000000000330000" filename = "" Region: id = 215 start_va = 0x7fef05c0000 end_va = 0x7fef149ffff entry_point = 0x7fef05c0000 region_type = mapped_file name = "system.windows.forms.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Windows.Forms\\6e89f5768c30e6d5cc74a6b198f437ce\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.windows.forms\\6e89f5768c30e6d5cc74a6b198f437ce\\system.windows.forms.ni.dll") Region: id = 216 start_va = 0x7fef14a0000 end_va = 0x7fef1689fff entry_point = 0x7fef14a0000 region_type = mapped_file name = "system.drawing.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Drawing\\839ea0590195c34c0b0054db5a9c3513\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.drawing\\839ea0590195c34c0b0054db5a9c3513\\system.drawing.ni.dll") Region: id = 217 start_va = 0x7fef1690000 end_va = 0x7fef22a2fff entry_point = 0x7fef1690000 region_type = mapped_file name = "system.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System\\76e0ae2162ace0d6430ce89ffdf32afa\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system\\76e0ae2162ace0d6430ce89ffdf32afa\\system.ni.dll") Region: id = 218 start_va = 0x340000 end_va = 0x341fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000340000" filename = "" Region: id = 219 start_va = 0x7fefd480000 end_va = 0x7fefd4a4fff entry_point = 0x7fefd480000 region_type = mapped_file name = "sspicli.dll" filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll") Region: id = 220 start_va = 0x5e0000 end_va = 0x67afff entry_point = 0x5e0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 221 start_va = 0x5e0000 end_va = 0x67afff entry_point = 0x5e0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 222 start_va = 0x7fef4440000 end_va = 0x7fef44dffff entry_point = 0x7fef4440000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_a4d6a923711520a9\\comctl32.dll") Region: id = 223 start_va = 0x350000 end_va = 0x35ffff entry_point = 0x0 region_type = private name = "private_0x0000000000350000" filename = "" Region: id = 224 start_va = 0x1ac90000 end_va = 0x1ad8ffff entry_point = 0x0 region_type = private name = "private_0x000000001ac90000" filename = "" Region: id = 225 start_va = 0x1ade0000 end_va = 0x1ae5ffff entry_point = 0x0 region_type = private name = "private_0x000000001ade0000" filename = "" Region: id = 226 start_va = 0x1ae60000 end_va = 0x1b04ffff entry_point = 0x1ae60000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 227 start_va = 0x1ae60000 end_va = 0x1b04ffff entry_point = 0x1ae60000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 228 start_va = 0x7fefc0f0000 end_va = 0x7fefc2e3fff entry_point = 0x7fefc0f0000 region_type = mapped_file name = "comctl32.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\\comctl32.dll") Region: id = 229 start_va = 0x360000 end_va = 0x360fff entry_point = 0x360000 region_type = mapped_file name = "windowsshell.manifest" filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest") Region: id = 230 start_va = 0x370000 end_va = 0x371fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000370000" filename = "" Region: id = 231 start_va = 0x1aff0000 end_va = 0x1b06ffff entry_point = 0x0 region_type = private name = "private_0x000000001aff0000" filename = "" Region: id = 232 start_va = 0x7fef8f30000 end_va = 0x7fef8f45fff entry_point = 0x7fef8f30000 region_type = mapped_file name = "nlssorting.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\nlssorting.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\nlssorting.dll") Region: id = 233 start_va = 0x1b070000 end_va = 0x1b341fff entry_point = 0x1b070000 region_type = mapped_file name = "sortdefault.nlp" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\sortdefault.nlp" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\sortdefault.nlp") Region: id = 234 start_va = 0x7fefbcf0000 end_va = 0x7fefbf04fff entry_point = 0x7fefbcf0000 region_type = mapped_file name = "gdiplus.dll" filename = "\\Windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_2b24536c71ed437a\\gdiplus.dll") Region: id = 235 start_va = 0x5e0000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 236 start_va = 0x380000 end_va = 0x39afff entry_point = 0x380000 region_type = mapped_file name = "gdipfontcachev1.dat" filename = "\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat") Region: id = 237 start_va = 0x1b3d0000 end_va = 0x1b4cffff entry_point = 0x0 region_type = private name = "private_0x000000001b3d0000" filename = "" Region: id = 238 start_va = 0x7fffffd5000 end_va = 0x7fffffd6fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd5000" filename = "" Region: id = 239 start_va = 0x1ae60000 end_va = 0x1af5ffff entry_point = 0x0 region_type = private name = "private_0x000000001ae60000" filename = "" Region: id = 240 start_va = 0x1fa0000 end_va = 0x204afff entry_point = 0x1fa0000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 241 start_va = 0x1fa0000 end_va = 0x204afff entry_point = 0x1fa0000 region_type = mapped_file name = "tahoma.ttf" filename = "\\Windows\\Fonts\\tahoma.ttf" (normalized: "c:\\windows\\fonts\\tahoma.ttf") Region: id = 242 start_va = 0x1b4d0000 end_va = 0x1c978fff entry_point = 0x1b4d0000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 243 start_va = 0x1b4d0000 end_va = 0x1c978fff entry_point = 0x1b4d0000 region_type = mapped_file name = "msjh.ttf" filename = "\\Windows\\Fonts\\msjh.ttf" (normalized: "c:\\windows\\fonts\\msjh.ttf") Region: id = 244 start_va = 0x1b4d0000 end_va = 0x1c992fff entry_point = 0x1b4d0000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 245 start_va = 0x1b4d0000 end_va = 0x1c992fff entry_point = 0x1b4d0000 region_type = mapped_file name = "msyh.ttf" filename = "\\Windows\\Fonts\\msyh.ttf" (normalized: "c:\\windows\\fonts\\msyh.ttf") Region: id = 246 start_va = 0x1b4d0000 end_va = 0x1b8f2fff entry_point = 0x1b4d0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 247 start_va = 0x1b4d0000 end_va = 0x1b8f2fff entry_point = 0x1b4d0000 region_type = mapped_file name = "malgun.ttf" filename = "\\Windows\\Fonts\\malgun.ttf" (normalized: "c:\\windows\\fonts\\malgun.ttf") Region: id = 248 start_va = 0x1b900000 end_va = 0x1bafffff entry_point = 0x0 region_type = private name = "private_0x000000001b900000" filename = "" Region: id = 249 start_va = 0x1fa0000 end_va = 0x203ffff entry_point = 0x1fa0000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 250 start_va = 0x1fa0000 end_va = 0x203ffff entry_point = 0x1fa0000 region_type = mapped_file name = "micross.ttf" filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf") Region: id = 251 start_va = 0x1fa0000 end_va = 0x201efff entry_point = 0x1fa0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 252 start_va = 0x1fa0000 end_va = 0x201efff entry_point = 0x1fa0000 region_type = mapped_file name = "segoeui.ttf" filename = "\\Windows\\Fonts\\segoeui.ttf" (normalized: "c:\\windows\\fonts\\segoeui.ttf") Region: id = 253 start_va = 0x1b4d0000 end_va = 0x1b73ffff entry_point = 0x0 region_type = private name = "private_0x000000001b4d0000" filename = "" Region: id = 254 start_va = 0x7fefbae0000 end_va = 0x7fefbaf7fff entry_point = 0x7fefbae0000 region_type = mapped_file name = "dwmapi.dll" filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll") Region: id = 255 start_va = 0x7fe94280000 end_va = 0x7fe9428ffff entry_point = 0x0 region_type = private name = "private_0x000007fe94280000" filename = "" Region: id = 256 start_va = 0x1bb00000 end_va = 0x1c42ffff entry_point = 0x1bb00000 region_type = mapped_file name = "staticcache.dat" filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat") Region: id = 257 start_va = 0x360000 end_va = 0x366fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000360000" filename = "" Region: id = 258 start_va = 0x380000 end_va = 0x381fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000380000" filename = "" Region: id = 259 start_va = 0x1c430000 end_va = 0x1c822fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x000000001c430000" filename = "" Region: id = 260 start_va = 0x7fe94290000 end_va = 0x7fe9429ffff entry_point = 0x0 region_type = private name = "private_0x000007fe94290000" filename = "" Region: id = 261 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 262 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 263 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 264 start_va = 0x390000 end_va = 0x39ffff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 265 start_va = 0x390000 end_va = 0x390fff entry_point = 0x0 region_type = private name = "private_0x0000000000390000" filename = "" Region: id = 266 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 267 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 268 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 269 start_va = 0x630000 end_va = 0x687fff entry_point = 0x0 region_type = pagefile_backed name = "pagefile_0x0000000000630000" filename = "" Region: id = 270 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 271 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 272 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 273 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 274 start_va = 0x7feefc30000 end_va = 0x7fef05b5fff entry_point = 0x7feefc30000 region_type = mapped_file name = "system.core.ni.dll" filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_64\\System.Core\\0b543c6391a29ab6773dc4ad0da611f2\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_64\\system.core\\0b543c6391a29ab6773dc4ad0da611f2\\system.core.ni.dll") Region: id = 275 start_va = 0x450000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 276 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 277 start_va = 0x620000 end_va = 0x62ffff entry_point = 0x0 region_type = private name = "private_0x0000000000620000" filename = "" Region: id = 278 start_va = 0x5f0000 end_va = 0x5fffff entry_point = 0x0 region_type = private name = "private_0x00000000005f0000" filename = "" Region: id = 279 start_va = 0x600000 end_va = 0x60ffff entry_point = 0x0 region_type = private name = "private_0x0000000000600000" filename = "" Region: id = 280 start_va = 0x610000 end_va = 0x61ffff entry_point = 0x0 region_type = private name = "private_0x0000000000610000" filename = "" Region: id = 281 start_va = 0x830000 end_va = 0x83ffff entry_point = 0x0 region_type = private name = "private_0x0000000000830000" filename = "" Region: id = 282 start_va = 0x840000 end_va = 0x84ffff entry_point = 0x0 region_type = private name = "private_0x0000000000840000" filename = "" Region: id = 283 start_va = 0x850000 end_va = 0x85ffff entry_point = 0x0 region_type = private name = "private_0x0000000000850000" filename = "" Region: id = 284 start_va = 0x860000 end_va = 0x86ffff entry_point = 0x0 region_type = private name = "private_0x0000000000860000" filename = "" Region: id = 285 start_va = 0x870000 end_va = 0x87ffff entry_point = 0x0 region_type = private name = "private_0x0000000000870000" filename = "" Region: id = 286 start_va = 0x1fa0000 end_va = 0x1faffff entry_point = 0x0 region_type = private name = "private_0x0000000001fa0000" filename = "" Region: id = 287 start_va = 0x1fb0000 end_va = 0x1fcffff entry_point = 0x0 region_type = private name = "private_0x0000000001fb0000" filename = "" Region: id = 288 start_va = 0x1fd0000 end_va = 0x1ffffff entry_point = 0x0 region_type = private name = "private_0x0000000001fd0000" filename = "" Region: id = 289 start_va = 0x2000000 end_va = 0x201ffff entry_point = 0x0 region_type = private name = "private_0x0000000002000000" filename = "" Region: id = 290 start_va = 0x2020000 end_va = 0x202ffff entry_point = 0x0 region_type = private name = "private_0x0000000002020000" filename = "" Region: id = 291 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 292 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 293 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 294 start_va = 0x450000 end_va = 0x45ffff entry_point = 0x0 region_type = private name = "private_0x0000000000450000" filename = "" Region: id = 295 start_va = 0x5e0000 end_va = 0x5effff entry_point = 0x0 region_type = private name = "private_0x00000000005e0000" filename = "" Region: id = 296 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 297 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 298 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 299 start_va = 0x1fa0000 end_va = 0x2001fff entry_point = 0x1fa0000 region_type = mapped_file name = "mscorrc.dll" filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\mscorrc.dll") Region: id = 300 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 301 start_va = 0x3b0000 end_va = 0x3bffff entry_point = 0x0 region_type = private name = "private_0x00000000003b0000" filename = "" Region: id = 302 start_va = 0x440000 end_va = 0x44ffff entry_point = 0x0 region_type = private name = "private_0x0000000000440000" filename = "" Region: id = 303 start_va = 0x3a0000 end_va = 0x3affff entry_point = 0x0 region_type = private name = "private_0x00000000003a0000" filename = "" Region: id = 304 start_va = 0x7fefceb0000 end_va = 0x7fefcec6fff entry_point = 0x7fefceb0000 region_type = mapped_file name = "cryptsp.dll" filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll") Region: id = 305 start_va = 0x830000 end_va = 0x874fff entry_point = 0x830000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 306 start_va = 0x830000 end_va = 0x874fff entry_point = 0x830000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 307 start_va = 0x830000 end_va = 0x874fff entry_point = 0x830000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 308 start_va = 0x830000 end_va = 0x874fff entry_point = 0x830000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 309 start_va = 0x830000 end_va = 0x874fff entry_point = 0x830000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 310 start_va = 0x7fefcbb0000 end_va = 0x7fefcbf6fff entry_point = 0x7fefcbb0000 region_type = mapped_file name = "rsaenh.dll" filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll") Region: id = 311 start_va = 0x7fefd020000 end_va = 0x7fefd041fff entry_point = 0x7fefd020000 region_type = mapped_file name = "bcrypt.dll" filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll") Region: id = 312 start_va = 0x1b510000 end_va = 0x1b60ffff entry_point = 0x0 region_type = private name = "private_0x000000001b510000" filename = "" Region: id = 313 start_va = 0x1b6c0000 end_va = 0x1b73ffff entry_point = 0x0 region_type = private name = "private_0x000000001b6c0000" filename = "" Region: id = 314 start_va = 0x7fffffd3000 end_va = 0x7fffffd4fff entry_point = 0x0 region_type = private name = "private_0x000007fffffd3000" filename = "" Region: id = 317 start_va = 0x1b7a0000 end_va = 0x1b89ffff entry_point = 0x0 region_type = private name = "private_0x000000001b7a0000" filename = "" Region: id = 318 start_va = 0x1c990000 end_va = 0x1ca8ffff entry_point = 0x0 region_type = private name = "private_0x000000001c990000" filename = "" Region: id = 319 start_va = 0x7ffffefc000 end_va = 0x7ffffefdfff entry_point = 0x0 region_type = private name = "private_0x000007ffffefc000" filename = "" Region: id = 320 start_va = 0x7ffffefe000 end_va = 0x7ffffefffff entry_point = 0x0 region_type = private name = "private_0x000007ffffefe000" filename = "" Thread: id = 1 os_tid = 0x7e0 [0021.305] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0 [0022.928] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x2ee4e0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77 [0022.988] IsAppThemed () returned 0x1 [0022.999] CoTaskMemAlloc (cb=0xf0) returned 0x1e3b080 [0023.000] CreateActCtxA (pActCtx=0x2eeab0) returned 0x1e22ea8 [0023.061] CoTaskMemFree (pv=0x1e3b080) [0023.098] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc13d [0023.098] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc13b [0023.118] GetUserNameW (in: lpBuffer=0x2ee8f0, pcbBuffer=0x2eec18 | out: lpBuffer="5p5NrGJn0jS HALPmcxz", pcbBuffer=0x2eec18) returned 1 [0023.219] GetComputerNameW (in: lpBuffer=0x2ee8f0, nSize=0x2eec18 | out: lpBuffer="XDUWTFONO", nSize=0x2eec18) returned 1 [0023.292] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0023.652] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7fef4440000 [0023.686] AdjustWindowRectEx (in: lpRect=0x2eeb50, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x2eeb50) returned 1 [0023.690] GetCurrentProcess () returned 0xffffffffffffffff [0023.690] DuplicateHandle (in: hSourceProcessHandle=0xffffffffffffffff, hSourceHandle=0xfffffffffffffffe, hTargetProcessHandle=0xffffffffffffffff, lpTargetHandle=0x2ee960, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x2ee960*=0x1e4) returned 1 [0023.708] GetCurrentActCtx (in: lphActCtx=0x2ee850 | out: lphActCtx=0x2ee850*=0x0) returned 1 [0023.708] ActivateActCtx (in: hActCtx=0x1e22ea8, lpCookie=0x2ee890 | out: hActCtx=0x1e22ea8, lpCookie=0x2ee890) returned 1 [0023.708] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0 [0024.175] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x7fefc0f0000 [0024.189] GetModuleHandleW (lpModuleName="user32.dll") returned 0x77450000 [0024.189] GetProcAddress (hModule=0x77450000, lpProcName="DefWindowProcW") returned 0x7769b0ac [0024.189] GetStockObject (i=5) returned 0x1900015 [0024.204] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0024.207] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0024.207] RegisterClassW (lpWndClass=0x2ee530) returned 0xc132 [0024.207] CoTaskMemFree (pv=0x1e4bd30) [0024.207] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0024.208] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffffffffffd, hMenu=0x0, hInstance=0x40000, lpParam=0x0) returned 0x201ac [0024.220] SetWindowLongPtrW (hWnd=0x201ac, nIndex=-4, dwNewLong=0x7769b0ac) returned 0x1aff131c [0024.225] GetWindowLongPtrW (hWnd=0x201ac, nIndex=-4) returned 0x7769b0ac [0024.371] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x2ed978 | out: phkResult=0x2ed978*=0x200) returned 0x0 [0024.372] RegQueryValueExW (in: hKey=0x200, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x2ed9c8, lpData=0x0, lpcbData=0x2ed9c0*=0x0 | out: lpType=0x2ed9c8*=0x0, lpData=0x0, lpcbData=0x2ed9c0*=0x0) returned 0x2 [0024.372] RegQueryValueExW (in: hKey=0x200, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x2ed9c8, lpData=0x0, lpcbData=0x2ed9c0*=0x0 | out: lpType=0x2ed9c8*=0x0, lpData=0x0, lpcbData=0x2ed9c0*=0x0) returned 0x2 [0024.372] RegCloseKey (hKey=0x200) returned 0x0 [0024.373] SetWindowLongPtrW (hWnd=0x201ac, nIndex=-4, dwNewLong=0x1aff136c) returned 0x7769b0ac [0024.374] GetWindowLongPtrW (hWnd=0x201ac, nIndex=-4) returned 0x1aff136c [0024.374] GetWindowLongPtrW (hWnd=0x201ac, nIndex=-16) returned 0x6c10000 [0024.376] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc131 [0024.377] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc13c [0024.377] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ac, Msg=0x81, wParam=0x0, lParam=0x2edf10) returned 0x1 [0024.377] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ac, Msg=0x83, wParam=0x0, lParam=0x2edfc0) returned 0x0 [0024.377] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201ac, Msg=0x1, wParam=0x0, lParam=0x2edf10) returned 0x0 [0024.378] GetClientRect (in: hWnd=0x201ac, lpRect=0x2ed9d0 | out: lpRect=0x2ed9d0) returned 1 [0024.378] GetWindowRect (in: hWnd=0x201ac, lpRect=0x2ed9d0 | out: lpRect=0x2ed9d0) returned 1 [0024.380] GetParent (hWnd=0x201ac) returned 0x0 [0024.380] DeactivateActCtx (dwFlags=0x0, ulCookie=0x10015e1600000001) returned 1 [0024.659] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4440000 [0024.659] AdjustWindowRectEx (in: lpRect=0x2eeaf8, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2eeaf8) returned 1 [0024.667] CreateCompatibleDC (hdc=0x0) returned 0x1701071b [0024.674] GetSystemDefaultLCID () returned 0x409 [0024.675] GetStockObject (i=17) returned 0x18a0025 [0024.678] GetObjectW (in: h=0x18a0025, c=92, pv=0x2ee5e0 | out: pv=0x2ee5e0) returned 92 [0024.679] GetDC (hWnd=0x0) returned 0x201081b [0024.701] GdiplusStartup (in: token=0x7fe94126cf8, input=0x2ecee8, output=0x2ecf98 | out: token=0x7fe94126cf8, output=0x2ecf98) returned 0x0 [0024.707] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0024.707] GdipCreateFontFromLogfontW (hdc=0x201081b, logfont=0x1e4bd30, font=0x2ee720) returned 0x0 [0025.047] CoTaskMemFree (pv=0x1e4bd30) [0025.048] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.048] CoTaskMemFree (pv=0x1e4bd30) [0025.048] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.048] CoTaskMemFree (pv=0x1e4bd30) [0025.049] GdipGetFontUnit (font=0x6241a0, unit=0x2ee690) returned 0x0 [0025.049] GdipGetFontSize (font=0x6241a0, size=0x2ee69c) returned 0x0 [0025.049] GdipGetFontStyle (font=0x6241a0, style=0x2ee688) returned 0x0 [0025.050] GdipGetFamily (font=0x6241a0, family=0x2ee680) returned 0x0 [0025.052] GdipGetFontSize (font=0x6241a0, size=0x220db90) returned 0x0 [0025.052] ReleaseDC (hWnd=0x0, hDC=0x201081b) returned 1 [0025.054] GetDC (hWnd=0x0) returned 0x570101c7 [0025.054] GdipCreateFromHDC (hdc=0x570101c7, graphics=0x2ee698) returned 0x0 [0025.056] GdipGetDpiY (graphics=0x1aebd3c0, dpi=0x220dd68) returned 0x0 [0025.057] GdipGetFontHeight (font=0x6241a0, graphics=0x1aebd3c0, height=0x2ee694) returned 0x0 [0025.058] GdipGetEmHeight (family=0x62c5e0, style=0, EmHeight=0x2ee698) returned 0x0 [0025.059] GdipGetLineSpacing (family=0x62c5e0, style=0, LineSpacing=0x2ee698) returned 0x0 [0025.059] GdipDeleteGraphics (graphics=0x1aebd3c0) returned 0x0 [0025.059] ReleaseDC (hWnd=0x0, hDC=0x570101c7) returned 1 [0025.064] GdipCreateFont (fontFamily=0x62c5e0, emSize=0x7fef150cd25, style=0, unit=0x3, font=0x220dcf8) returned 0x0 [0025.064] GdipGetFontSize (font=0x1af23a40, size=0x220dd00) returned 0x0 [0025.064] GdipDeleteFont (font=0x6241a0) returned 0x0 [0025.067] GetDC (hWnd=0x0) returned 0x570101c7 [0025.068] GdipCreateFromHDC (hdc=0x570101c7, graphics=0x2ee748) returned 0x0 [0025.068] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.068] GdipGetLogFontW (font=0x1af23a40, graphics=0x1aebd3c0, logfontW=0x1e4bd30) returned 0x0 [0025.068] CoTaskMemFree (pv=0x1e4bd30) [0025.068] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.069] CoTaskMemFree (pv=0x1e4bd30) [0025.069] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.069] CoTaskMemFree (pv=0x1e4bd30) [0025.069] GdipDeleteGraphics (graphics=0x1aebd3c0) returned 0x0 [0025.069] ReleaseDC (hWnd=0x0, hDC=0x570101c7) returned 1 [0025.069] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.069] CreateFontIndirectW (lplf=0x1e4bd30) returned 0x300a0156 [0025.069] CoTaskMemFree (pv=0x1e4bd30) [0025.070] SelectObject (hdc=0x1701071b, h=0x300a0156) returned 0x18a002e [0025.070] GetTextMetricsW (in: hdc=0x1701071b, lptm=0x2ee9c8 | out: lptm=0x2ee9c8) returned 1 [0025.071] GetTextExtentPoint32W (in: hdc=0x1701071b, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x220e0e0 | out: psizl=0x220e0e0) returned 1 [0025.073] SelectObject (hdc=0x1701071b, h=0x18a002e) returned 0x300a0156 [0025.074] DeleteDC (hdc=0x1701071b) returned 1 [0025.075] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4440000 [0025.075] AdjustWindowRectEx (in: lpRect=0x2ee630, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee630) returned 1 [0025.075] AdjustWindowRectEx (in: lpRect=0x2ee8b0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee8b0) returned 1 [0025.075] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fef4440000 [0025.075] AdjustWindowRectEx (in: lpRect=0x2ee520, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee520) returned 1 [0025.075] AdjustWindowRectEx (in: lpRect=0x2ee6a0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee6a0) returned 1 [0025.092] GetSystemMetrics (nIndex=34) returned 132 [0025.092] GetSystemMetrics (nIndex=35) returned 38 [0025.094] GetCurrentActCtx (in: lphActCtx=0x2eeba0 | out: lphActCtx=0x2eeba0*=0x0) returned 1 [0025.094] ActivateActCtx (in: hActCtx=0x1e22ea8, lpCookie=0x2eebe0 | out: hActCtx=0x1e22ea8, lpCookie=0x2eebe0) returned 1 [0025.096] GetCurrentActCtx (in: lphActCtx=0x2ee830 | out: lphActCtx=0x2ee830*=0x1e22ea8) returned 1 [0025.097] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc0f0000 [0025.097] AdjustWindowRectEx (in: lpRect=0x2ee750, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x2ee750) returned 1 [0025.097] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0025.097] CreateWindowExW (dwExStyle=0x50000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=-2147483648, Y=-2147483648, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x40000, lpParam=0x0) returned 0x201a8 [0025.097] SetWindowLongPtrW (hWnd=0x201a8, nIndex=-4, dwNewLong=0x7769b0ac) returned 0x1aff131c [0025.097] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-4) returned 0x7769b0ac [0025.097] SetWindowLongPtrW (hWnd=0x201a8, nIndex=-4, dwNewLong=0x1aff13bc) returned 0x7769b0ac [0025.097] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-4) returned 0x1aff13bc [0025.097] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-16) returned 0x6cf0000 [0025.098] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x81, wParam=0x0, lParam=0x2edef0) returned 0x1 [0025.099] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x83, wParam=0x0, lParam=0x2edfa0) returned 0x0 [0025.193] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x1, wParam=0x0, lParam=0x2eded0) returned 0x0 [0025.193] GetClientRect (in: hWnd=0x201a8, lpRect=0x2ed950 | out: lpRect=0x2ed950) returned 1 [0025.193] GetWindowRect (in: hWnd=0x201a8, lpRect=0x2ed950 | out: lpRect=0x2ed950) returned 1 [0025.194] SetWindowTextW (hWnd=0x201a8, lpString="Form1") returned 1 [0025.194] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xc, wParam=0x0, lParam=0x220ceec) returned 0x1 [0025.235] GetUserObjectInformationA (in: hObj=0x44, nIndex=1, pvInfo=0x220e900, nLength=0xc, lpnLengthNeeded=0x2ed6e0 | out: pvInfo=0x220e900, lpnLengthNeeded=0x2ed6e0) returned 1 [0025.245] SetConsoleCtrlHandler (HandlerRoutine=0x1aff140c, Add=1) returned 1 [0025.248] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0025.248] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0025.249] GetClassInfoW (in: hInstance=0x40000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x220e9c0 | out: lpWndClass=0x220e9c0) returned 0 [0025.250] CoTaskMemAlloc (cb=0x58) returned 0x1e40110 [0025.250] RegisterClassW (lpWndClass=0x2ed4f0) returned 0xc139 [0025.250] CoTaskMemFree (pv=0x1e40110) [0025.251] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x40000, lpParam=0x0) returned 0x50128 [0025.261] NtdllDefWindowProc_W (hWnd=0x50128, Msg=0x83, wParam=0x0, lParam=0x2ecf10) returned 0x0 [0025.261] NtdllDefWindowProc_W (hWnd=0x50128, Msg=0x1, wParam=0x0, lParam=0x2ece00) returned 0x0 [0025.261] NtdllDefWindowProc_W (hWnd=0x50128, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0 [0025.261] NtdllDefWindowProc_W (hWnd=0x50128, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0 [0025.269] GetStartupInfoW (in: lpStartupInfo=0x220f0f8 | out: lpStartupInfo=0x220f0f8*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0025.287] GetParent (hWnd=0x201a8) returned 0x0 [0025.287] SetWindowLongPtrW (hWnd=0x201a8, nIndex=-8, dwNewLong=0x0) returned 0x0 [0025.297] GetSystemMetrics (nIndex=11) returned 32 [0025.297] GetSystemMetrics (nIndex=12) returned 32 [0025.297] GetDC (hWnd=0x0) returned 0x570101c7 [0025.297] GetDeviceCaps (hdc=0x570101c7, index=12) returned 32 [0025.297] GetDeviceCaps (hdc=0x570101c7, index=14) returned 1 [0025.298] ReleaseDC (hWnd=0x0, hDC=0x570101c7) returned 1 [0025.298] CreateIconFromResourceEx (presbits=0x2211d50, dwResSize=0x10a8, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0xd0125 [0025.299] GetSystemMetrics (nIndex=49) returned 16 [0025.299] GetSystemMetrics (nIndex=50) returned 16 [0025.300] CreateIconFromResourceEx (presbits=0x2212e58, dwResSize=0x468, fIcon=1, dwVer=0x30000, cxDesired=0, cyDesired=0, Flags=0x0) returned 0x201a1 [0025.301] SendMessageW (hWnd=0x201a8, Msg=0x80, wParam=0x0, lParam=0x201a1) returned 0x0 [0025.301] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x80, wParam=0x0, lParam=0x201a1) returned 0x0 [0025.301] SendMessageW (hWnd=0x201a8, Msg=0x80, wParam=0x1, lParam=0xd0125) returned 0x0 [0025.301] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x80, wParam=0x1, lParam=0xd0125) returned 0x0 [0025.313] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201a1 [0025.315] GetSystemMenu (hWnd=0x201a8, bRevert=0) returned 0x40195 [0025.316] GetWindowPlacement (in: hWnd=0x201a8, lpwndpl=0x2ee838 | out: lpwndpl=0x2ee838) returned 1 [0025.317] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0025.317] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0025.317] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0025.317] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0025.317] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0025.317] GetClientRect (in: hWnd=0x201a8, lpRect=0x2ee900 | out: lpRect=0x2ee900) returned 1 [0025.317] GetClientRect (in: hWnd=0x201a8, lpRect=0x2ee830 | out: lpRect=0x2ee830) returned 1 [0025.317] GetWindowRect (in: hWnd=0x201a8, lpRect=0x2ee830 | out: lpRect=0x2ee830) returned 1 [0025.317] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc0f0000 [0025.318] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-16) returned 0x6cf0000 [0025.318] GetWindowTextLengthW (hWnd=0x201a8) returned 5 [0025.318] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.318] GetSystemMetrics (nIndex=42) returned 0 [0025.318] GetWindowTextW (in: hWnd=0x201a8, lpString=0x2ee640, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.318] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xd, wParam=0x6, lParam=0x2ee640) returned 0x5 [0025.319] GetWindowTextLengthW (hWnd=0x201a8) returned 5 [0025.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.319] GetSystemMetrics (nIndex=42) returned 0 [0025.319] GetWindowTextW (in: hWnd=0x201a8, lpString=0x2ee640, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xd, wParam=0x6, lParam=0x2ee640) returned 0x5 [0025.319] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-16) returned 0x6cf0000 [0025.319] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-20) returned 0x50100 [0025.319] SetWindowLongPtrW (hWnd=0x201a8, nIndex=-16, dwNewLong=0x2cf0000) returned 0x6cf0000 [0025.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2ee710) returned 0x0 [0025.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2ee710) returned 0x0 [0025.319] SetWindowLongPtrW (hWnd=0x201a8, nIndex=-20, dwNewLong=0x50000) returned 0x50100 [0025.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2ee710) returned 0x0 [0025.319] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2ee710) returned 0x0 [0025.320] SetWindowPos (hWnd=0x201a8, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0025.320] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x46, wParam=0x0, lParam=0x2ee760) returned 0x0 [0025.320] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x83, wParam=0x1, lParam=0x2ee730) returned 0x0 [0025.320] GetWindowPlacement (in: hWnd=0x201a8, lpwndpl=0x2ee338 | out: lpwndpl=0x2ee338) returned 1 [0025.320] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x47, wParam=0x0, lParam=0x2ee760) returned 0x0 [0025.320] GetClientRect (in: hWnd=0x201a8, lpRect=0x2ee1d0 | out: lpRect=0x2ee1d0) returned 1 [0025.320] GetWindowRect (in: hWnd=0x201a8, lpRect=0x2ee1d0 | out: lpRect=0x2ee1d0) returned 1 [0025.322] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x83, wParam=0x1, lParam=0x2ee0c0) returned 0x0 [0025.322] RedrawWindow (hWnd=0x201a8, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0025.322] GetSystemMenu (hWnd=0x201a8, bRevert=0) returned 0x40195 [0025.322] GetWindowPlacement (in: hWnd=0x201a8, lpwndpl=0x2ee7d8 | out: lpwndpl=0x2ee7d8) returned 1 [0025.322] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0025.322] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0025.322] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0025.322] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0025.322] EnableMenuItem (hMenu=0x40195, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0025.322] ShowWindow (hWnd=0x201a8, nCmdShow=5) [0025.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x18, wParam=0x1, lParam=0x0) returned 0x0 [0025.323] GetWindowTextLengthW (hWnd=0x201a8) returned 5 [0025.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.323] GetSystemMetrics (nIndex=42) returned 0 [0025.323] GetWindowTextW (in: hWnd=0x201a8, lpString=0x2ee1a0, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.323] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xd, wParam=0x6, lParam=0x2ee1a0) returned 0x5 [0025.342] GetCurrentThreadId () returned 0x7e0 [0025.350] EnumThreadWindows (dwThreadId=0x7e0, lpfn=0x1aff14ac, lParam=0x201a8) returned 1 [0025.423] GetWindowLongPtrW (hWnd=0x50128, nIndex=-8) returned 0x0 [0025.423] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-8) returned 0x0 [0025.423] GetWindowLongPtrW (hWnd=0x201ae, nIndex=-8) returned 0x201a8 [0025.503] SetWindowLongPtrW (hWnd=0x201ae, nIndex=-8, dwNewLong=0x0) returned 0x201a8 [0025.506] GetParent (hWnd=0x201a8) returned 0x0 [0025.506] GetWindowLongPtrW (hWnd=0x201a8, nIndex=-20) returned 0x50100 [0025.506] DestroyWindow (hWnd=0x201a8) returned 1 [0025.506] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x90, wParam=0x0, lParam=0x0) returned 0x0 [0025.510] GetWindowTextLengthW (hWnd=0x201a8) returned 5 [0025.510] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.510] GetSystemMetrics (nIndex=42) returned 0 [0025.510] GetWindowTextW (in: hWnd=0x201a8, lpString=0x2ed720, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.510] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0xd, wParam=0x6, lParam=0x2ed720) returned 0x5 [0025.511] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x2, wParam=0x0, lParam=0x0) returned 0x0 [0025.511] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x201a8, Msg=0x82, wParam=0x0, lParam=0x0) returned 0x0 [0025.515] GetCurrentActCtx (in: lphActCtx=0x2edf10 | out: lphActCtx=0x2edf10*=0x1e22ea8) returned 1 [0025.515] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc0f0000 [0025.515] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0025.515] CreateWindowExW (dwExStyle=0x10000, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r12_ad1", lpWindowName="Form1", dwStyle=0x2cf0000, X=50, Y=50, nWidth=300, nHeight=300, hWndParent=0x0, hMenu=0x0, hInstance=0x40000, lpParam=0x0) returned 0x60126 [0025.515] SetWindowLongPtrW (hWnd=0x60126, nIndex=-4, dwNewLong=0x7769b0ac) returned 0x1aff131c [0025.515] GetWindowLongPtrW (hWnd=0x60126, nIndex=-4) returned 0x7769b0ac [0025.515] SetWindowLongPtrW (hWnd=0x60126, nIndex=-4, dwNewLong=0x1aff14fc) returned 0x7769b0ac [0025.516] GetWindowLongPtrW (hWnd=0x60126, nIndex=-4) returned 0x1aff14fc [0025.516] GetWindowLongPtrW (hWnd=0x60126, nIndex=-16) returned 0x6cf0000 [0025.516] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x81, wParam=0x0, lParam=0x2ed5d0) returned 0x1 [0025.516] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x83, wParam=0x0, lParam=0x2ed680) returned 0x0 [0025.517] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x1, wParam=0x0, lParam=0x2ed5b0) returned 0x0 [0025.517] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed030 | out: lpRect=0x2ed030) returned 1 [0025.517] GetWindowRect (in: hWnd=0x60126, lpRect=0x2ed030 | out: lpRect=0x2ed030) returned 1 [0025.517] SetWindowTextW (hWnd=0x60126, lpString="Form1") returned 1 [0025.517] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xc, wParam=0x0, lParam=0x22137f4) returned 0x1 [0025.517] GetStartupInfoW (in: lpStartupInfo=0x2213c80 | out: lpStartupInfo=0x2213c80*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0025.517] GetParent (hWnd=0x60126) returned 0x0 [0025.518] GetStockObject (i=5) returned 0x1900015 [0025.518] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0025.519] CoTaskMemAlloc (cb=0x5c) returned 0x1e4bd30 [0025.519] RegisterClassW (lpWndClass=0x2edc00) returned 0xc138 [0025.519] CoTaskMemFree (pv=0x1e4bd30) [0025.519] GetModuleHandleW (lpModuleName=0x0) returned 0x40000 [0025.519] CreateWindowExW (dwExStyle=0x80, lpClassName="WindowsForms10.Window.0.app.0.141b42a_r12_ad1", lpWindowName=0x0, dwStyle=0x0, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x40000, lpParam=0x0) returned 0x5010a [0025.519] SetWindowLongPtrW (hWnd=0x5010a, nIndex=-4, dwNewLong=0x7769b0ac) returned 0x1aff154c [0025.519] GetWindowLongPtrW (hWnd=0x5010a, nIndex=-4) returned 0x7769b0ac [0025.520] SetWindowLongPtrW (hWnd=0x5010a, nIndex=-4, dwNewLong=0x1aff159c) returned 0x7769b0ac [0025.520] GetWindowLongPtrW (hWnd=0x5010a, nIndex=-4) returned 0x1aff159c [0025.520] GetWindowLongPtrW (hWnd=0x5010a, nIndex=-16) returned 0x4c00000 [0025.521] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0x24, wParam=0x0, lParam=0x2ed670) returned 0x0 [0025.521] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0x81, wParam=0x0, lParam=0x2ed5e0) returned 0x1 [0025.521] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0x83, wParam=0x0, lParam=0x2ed690) returned 0x0 [0025.521] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0x1, wParam=0x0, lParam=0x2ed5e0) returned 0x0 [0025.521] SetWindowLongPtrW (hWnd=0x60126, nIndex=-8, dwNewLong=0x5010a) returned 0x0 [0025.522] SendMessageW (hWnd=0x60126, Msg=0x80, wParam=0x0, lParam=0x201a1) returned 0x0 [0025.522] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x80, wParam=0x0, lParam=0x201a1) returned 0x0 [0025.522] SendMessageW (hWnd=0x60126, Msg=0x80, wParam=0x1, lParam=0xd0125) returned 0x0 [0025.522] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x80, wParam=0x1, lParam=0xd0125) returned 0x0 [0025.522] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7f, wParam=0x2, lParam=0x0) returned 0x201a1 [0025.523] GetSystemMenu (hWnd=0x60126, bRevert=0) returned 0x50195 [0025.523] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2edf18 | out: lpwndpl=0x2edf18) returned 1 [0025.523] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0025.523] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0025.523] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0025.523] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf120, uEnable=0x1) returned 0 [0025.523] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0025.523] GetClientRect (in: hWnd=0x60126, lpRect=0x2edfe0 | out: lpRect=0x2edfe0) returned 1 [0025.523] GetClientRect (in: hWnd=0x60126, lpRect=0x2edf10 | out: lpRect=0x2edf10) returned 1 [0025.523] GetWindowRect (in: hWnd=0x60126, lpRect=0x2edf10 | out: lpRect=0x2edf10) returned 1 [0025.523] SetWindowPos (hWnd=0x60126, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x57) returned 1 [0025.523] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x46, wParam=0x0, lParam=0x2ede70) returned 0x0 [0025.524] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0025.525] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2eda68 | out: lpwndpl=0x2eda68) returned 1 [0025.526] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed980 | out: lpRect=0x2ed980) returned 1 [0025.526] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.526] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.526] GetSystemMetrics (nIndex=42) returned 0 [0025.526] GetWindowTextW (in: hWnd=0x60126, lpString=0x2ed6f0, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.526] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2ed6f0) returned 0x5 [0025.526] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed768 | out: lpRect=0x2ed768) returned 1 [0025.548] GetSysColor (nIndex=10) returned 0xb4b4b4 [0025.548] GetSysColor (nIndex=2) returned 0xd1b499 [0025.548] GetSysColor (nIndex=9) returned 0x0 [0025.548] GetSysColor (nIndex=12) returned 0xababab [0025.548] GetSysColor (nIndex=15) returned 0xf0f0f0 [0025.548] GetSysColor (nIndex=20) returned 0xffffff [0025.548] GetSysColor (nIndex=16) returned 0xa0a0a0 [0025.548] GetSysColor (nIndex=15) returned 0xf0f0f0 [0025.548] GetSysColor (nIndex=16) returned 0xa0a0a0 [0025.548] GetSysColor (nIndex=21) returned 0x696969 [0025.548] GetSysColor (nIndex=22) returned 0xe3e3e3 [0025.548] GetSysColor (nIndex=20) returned 0xffffff [0025.549] GetSysColor (nIndex=18) returned 0x0 [0025.549] GetSysColor (nIndex=1) returned 0x0 [0025.549] GetSysColor (nIndex=27) returned 0xead1b9 [0025.549] GetSysColor (nIndex=28) returned 0xf2e4d7 [0025.549] GetSysColor (nIndex=17) returned 0x6d6d6d [0025.549] GetSysColor (nIndex=13) returned 0xff9933 [0025.549] GetSysColor (nIndex=14) returned 0xffffff [0025.549] GetSysColor (nIndex=26) returned 0xcc6600 [0025.549] GetSysColor (nIndex=11) returned 0xfcf7f4 [0025.549] GetSysColor (nIndex=3) returned 0xdbcdbf [0025.549] GetSysColor (nIndex=19) returned 0x544e43 [0025.549] GetSysColor (nIndex=24) returned 0xe1ffff [0025.549] GetSysColor (nIndex=23) returned 0x0 [0025.549] GetSysColor (nIndex=4) returned 0xf0f0f0 [0025.549] GetSysColor (nIndex=30) returned 0xf0f0f0 [0025.549] GetSysColor (nIndex=29) returned 0xff9933 [0025.549] GetSysColor (nIndex=7) returned 0x0 [0025.549] GetSysColor (nIndex=0) returned 0xc8c8c8 [0025.549] GetSysColor (nIndex=5) returned 0xffffff [0025.549] GetSysColor (nIndex=6) returned 0x646464 [0025.549] GetSysColor (nIndex=8) returned 0x0 [0025.550] GetSystemMetrics (nIndex=80) returned 1 [0025.551] EnumDisplayMonitors (hdc=0x0, lprcClip=0x0, lpfnEnum=0x1aff15ec, dwData=0x0) returned 1 [0025.552] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x2ecf60 | out: lpmi=0x2ecf60) returned 1 [0025.552] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x13010823 [0025.553] GetDeviceCaps (hdc=0x13010823, index=12) returned 32 [0025.553] GetDeviceCaps (hdc=0x13010823, index=14) returned 1 [0025.553] DeleteDC (hdc=0x13010823) returned 1 [0025.553] GetCurrentObject (hdc=0x570101c7, type=0x1) returned 0x1b00017 [0025.553] GetCurrentObject (hdc=0x570101c7, type=0x2) returned 0x1900010 [0025.554] GetCurrentObject (hdc=0x570101c7, type=0x7) returned 0x1050032 [0025.554] GetCurrentObject (hdc=0x570101c7, type=0x6) returned 0x18a002e [0025.556] SaveDC (hdc=0x570101c7) returned 1 [0025.557] GetNearestColor (hdc=0x570101c7, color=0xf0f0f0) returned 0xf0f0f0 [0025.560] CreateSolidBrush (color=0xf0f0f0) returned 0x6100821 [0025.561] FillRect (hDC=0x570101c7, lprc=0x2ed458, hbr=0x6100821) returned 1 [0025.562] DeleteObject (ho=0x6100821) returned 1 [0025.563] RestoreDC (hdc=0x570101c7, nSavedDC=-1) returned 1 [0025.565] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2eda48 | out: lpwndpl=0x2eda48) returned 1 [0025.565] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x47, wParam=0x0, lParam=0x2ede70) returned 0x0 [0025.565] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed8e0 | out: lpRect=0x2ed8e0) returned 1 [0025.565] GetWindowRect (in: hWnd=0x60126, lpRect=0x2ed8e0 | out: lpRect=0x2ed8e0) returned 1 [0025.565] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x83, wParam=0x1, lParam=0x2ed7d0) returned 0x0 [0025.567] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0025.568] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2ed3f8 | out: lpwndpl=0x2ed3f8) returned 1 [0025.568] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed310 | out: lpRect=0x2ed310) returned 1 [0025.568] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.568] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.568] GetSystemMetrics (nIndex=42) returned 0 [0025.568] GetWindowTextW (in: hWnd=0x60126, lpString=0x2ed080, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.568] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2ed080) returned 0x5 [0025.568] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed0f8 | out: lpRect=0x2ed0f8) returned 1 [0025.568] GetCurrentObject (hdc=0x70107ff, type=0x1) returned 0x1b00017 [0025.568] GetCurrentObject (hdc=0x70107ff, type=0x2) returned 0x1900010 [0025.568] GetCurrentObject (hdc=0x70107ff, type=0x7) returned 0x1050032 [0025.568] GetCurrentObject (hdc=0x70107ff, type=0x6) returned 0x18a002e [0025.568] SaveDC (hdc=0x70107ff) returned 1 [0025.568] GetNearestColor (hdc=0x70107ff, color=0xf0f0f0) returned 0xf0f0f0 [0025.568] CreateSolidBrush (color=0xf0f0f0) returned 0x7100821 [0025.568] FillRect (hDC=0x70107ff, lprc=0x2ecde8, hbr=0x7100821) returned 1 [0025.568] DeleteObject (ho=0x7100821) returned 1 [0025.569] RestoreDC (hdc=0x70107ff, nSavedDC=-1) returned 1 [0025.569] SetWindowLongPtrW (hWnd=0x60126, nIndex=-8, dwNewLong=0x5010a) returned 0x5010a [0025.569] SendMessageW (hWnd=0x5010a, Msg=0x80, wParam=0x1, lParam=0xd0125) returned 0x0 [0025.569] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0x80, wParam=0x1, lParam=0xd0125) returned 0x0 [0025.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0xd, wParam=0x104, lParam=0x1adf48b0) returned 0x0 [0025.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x5010a, Msg=0xd, wParam=0x104, lParam=0x1adf48b0) returned 0x0 [0025.570] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc0f0000 [0025.570] GetWindowLongPtrW (hWnd=0x60126, nIndex=-16) returned 0x16cf0000 [0025.570] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.570] GetSystemMetrics (nIndex=42) returned 0 [0025.570] GetWindowTextW (in: hWnd=0x60126, lpString=0x2edd20, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2edd20) returned 0x5 [0025.570] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.570] GetSystemMetrics (nIndex=42) returned 0 [0025.570] GetWindowTextW (in: hWnd=0x60126, lpString=0x2edd20, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.570] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2edd20) returned 0x5 [0025.570] GetWindowLongPtrW (hWnd=0x60126, nIndex=-16) returned 0x16cf0000 [0025.570] GetWindowLongPtrW (hWnd=0x60126, nIndex=-20) returned 0x10100 [0025.571] SetWindowLongPtrW (hWnd=0x60126, nIndex=-16, dwNewLong=0x12cf0000) returned 0x16cf0000 [0025.571] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2eddf0) returned 0x0 [0025.571] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2eddf0) returned 0x0 [0025.572] SetWindowLongPtrW (hWnd=0x60126, nIndex=-20, dwNewLong=0x10000) returned 0x10100 [0025.572] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2eddf0) returned 0x0 [0025.572] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2eddf0) returned 0x0 [0025.572] SetWindowPos (hWnd=0x60126, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0025.572] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x46, wParam=0x0, lParam=0x2ede40) returned 0x0 [0025.572] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x83, wParam=0x1, lParam=0x2ede10) returned 0x0 [0025.572] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x85, wParam=0x1, lParam=0x0) returned 0x0 [0025.573] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2eda38 | out: lpwndpl=0x2eda38) returned 1 [0025.573] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed950 | out: lpRect=0x2ed950) returned 1 [0025.573] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.573] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.573] GetSystemMetrics (nIndex=42) returned 0 [0025.573] GetWindowTextW (in: hWnd=0x60126, lpString=0x2ed6c0, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.573] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2ed6c0) returned 0x5 [0025.573] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed738 | out: lpRect=0x2ed738) returned 1 [0025.573] GetCurrentObject (hdc=0x70107ff, type=0x1) returned 0x1b00017 [0025.573] GetCurrentObject (hdc=0x70107ff, type=0x2) returned 0x1900010 [0025.573] GetCurrentObject (hdc=0x70107ff, type=0x7) returned 0x1050032 [0025.573] GetCurrentObject (hdc=0x70107ff, type=0x6) returned 0x18a002e [0025.574] SaveDC (hdc=0x70107ff) returned 1 [0025.574] GetNearestColor (hdc=0x70107ff, color=0xf0f0f0) returned 0xf0f0f0 [0025.574] CreateSolidBrush (color=0xf0f0f0) returned 0x8100821 [0025.574] FillRect (hDC=0x70107ff, lprc=0x2ed428, hbr=0x8100821) returned 1 [0025.574] DeleteObject (ho=0x8100821) returned 1 [0025.574] RestoreDC (hdc=0x70107ff, nSavedDC=-1) returned 1 [0025.574] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2eda18 | out: lpwndpl=0x2eda18) returned 1 [0025.574] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x47, wParam=0x0, lParam=0x2ede40) returned 0x0 [0025.574] GetClientRect (in: hWnd=0x60126, lpRect=0x2ed8b0 | out: lpRect=0x2ed8b0) returned 1 [0025.574] GetWindowRect (in: hWnd=0x60126, lpRect=0x2ed8b0 | out: lpRect=0x2ed8b0) returned 1 [0025.574] RedrawWindow (hWnd=0x60126, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0025.574] GetSystemMenu (hWnd=0x60126, bRevert=0) returned 0x50195 [0025.574] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2edeb8 | out: lpwndpl=0x2edeb8) returned 1 [0025.574] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0025.574] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0025.574] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0025.574] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0025.574] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0025.574] SetWindowLongPtrW (hWnd=0x201ae, nIndex=-8, dwNewLong=0x60126) returned 0x50128 [0025.694] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x7fefc0f0000 [0025.695] GetWindowLongPtrW (hWnd=0x60126, nIndex=-16) returned 0x16cf0000 [0025.695] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.695] GetSystemMetrics (nIndex=42) returned 0 [0025.695] GetWindowTextW (in: hWnd=0x60126, lpString=0x2ede90, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2ede90) returned 0x5 [0025.695] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.695] GetSystemMetrics (nIndex=42) returned 0 [0025.695] GetWindowTextW (in: hWnd=0x60126, lpString=0x2ede90, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2ede90) returned 0x5 [0025.695] GetWindowLongPtrW (hWnd=0x60126, nIndex=-16) returned 0x16cf0000 [0025.695] GetWindowLongPtrW (hWnd=0x60126, nIndex=-20) returned 0x10100 [0025.695] SetWindowLongPtrW (hWnd=0x60126, nIndex=-16, dwNewLong=0x12cf0000) returned 0x16cf0000 [0025.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7c, wParam=0xfffffffffffffff0, lParam=0x2edf60) returned 0x0 [0025.695] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7d, wParam=0xfffffffffffffff0, lParam=0x2edf60) returned 0x0 [0025.696] SetWindowLongPtrW (hWnd=0x60126, nIndex=-20, dwNewLong=0x90000) returned 0x10100 [0025.696] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7c, wParam=0xffffffffffffffec, lParam=0x2edf60) returned 0x0 [0025.705] BeginPaint (in: hWnd=0x60126, lpPaint=0x2ed868 | out: lpPaint=0x2ed868) returned 0x10107fb [0025.706] GdipCreateHalftonePalette () returned 0x2108025a [0025.706] SelectPalette (hdc=0x10107fb, hPal=0x2108025a, bForceBkgd=1) returned 0x188000b [0025.706] GetWindowTextLengthW (hWnd=0x60126) returned 5 [0025.706] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xe, wParam=0x0, lParam=0x0) returned 0x5 [0025.706] GetSystemMetrics (nIndex=42) returned 0 [0025.706] GetWindowTextW (in: hWnd=0x60126, lpString=0x2ed710, nMaxCount=6 | out: lpString="Form1") returned 5 [0025.706] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0xd, wParam=0x6, lParam=0x2ed710) returned 0x5 [0025.706] SelectPalette (hdc=0x10107fb, hPal=0x188000b, bForceBkgd=0) returned 0x2108025a [0025.707] EndPaint (hWnd=0x60126, lpPaint=0x2ed808) returned 1 [0025.707] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x7d, wParam=0xffffffffffffffec, lParam=0x2edf60) returned 0x0 [0025.707] SetWindowPos (hWnd=0x60126, hWndInsertAfter=0x0, X=0, Y=0, cx=0, cy=0, uFlags=0x37) returned 1 [0025.707] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x46, wParam=0x0, lParam=0x2edfb0) returned 0x0 [0025.707] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x83, wParam=0x1, lParam=0x2edf80) returned 0x0 [0025.708] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2edb88 | out: lpwndpl=0x2edb88) returned 1 [0025.708] CallWindowProcW (lpPrevWndFunc=0x7769b0ac, hWnd=0x60126, Msg=0x47, wParam=0x0, lParam=0x2edfb0) returned 0x0 [0025.708] GetClientRect (in: hWnd=0x60126, lpRect=0x2eda20 | out: lpRect=0x2eda20) returned 1 [0025.708] GetWindowRect (in: hWnd=0x60126, lpRect=0x2eda20 | out: lpRect=0x2eda20) returned 1 [0025.708] RedrawWindow (hWnd=0x60126, lprcUpdate=0x0, hrgnUpdate=0x0, flags=0x85) returned 1 [0025.708] GetSystemMenu (hWnd=0x60126, bRevert=0) returned 0x50195 [0025.708] GetWindowPlacement (in: hWnd=0x60126, lpwndpl=0x2ee028 | out: lpwndpl=0x2ee028) returned 1 [0025.708] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf020, uEnable=0x0) returned 0 [0025.708] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf030, uEnable=0x0) returned 0 [0025.708] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf060, uEnable=0x0) returned 0 [0025.708] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf120, uEnable=0x1) returned 1 [0025.708] EnableMenuItem (hMenu=0x50195, uIDEnableItem=0xf000, uEnable=0x0) returned 0 [0025.710] SetLayeredWindowAttributes (hwnd=0x60126, crKey=0x0, bAlpha=0x0, dwFlags=0x2) returned 1 [0025.756] GetLogicalDrives () returned 0x4 [0026.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0026.138] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edc00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0026.139] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edba0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0026.157] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2eddb0 | out: lpFindFileData=0x2eddb0) returned 0x1e40290 [0026.158] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.159] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.159] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.159] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.159] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.160] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.160] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.160] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.160] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.161] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.161] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.161] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.161] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.161] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.162] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.162] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.162] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 0 [0026.162] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0026.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee060) returned 1 [0026.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee020) returned 1 [0026.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee110) returned 1 [0026.162] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edc00, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0026.162] GetFullPathNameW (in: lpFileName="C:\\", nBufferLength=0x105, lpBuffer=0x2edba0, lpFilePart=0x0 | out: lpBuffer="C:\\", lpFilePart=0x0) returned 0x3 [0026.163] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x2eddb0 | out: lpFindFileData=0x2eddb0) returned 0x1e40290 [0026.174] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.174] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.174] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.175] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.175] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.175] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.175] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.175] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.175] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 1 [0026.176] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2ede00 | out: lpFindFileData=0x2ede00) returned 0 [0026.177] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0026.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee060) returned 1 [0026.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ee020) returned 1 [0026.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0026.214] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0026.214] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0026.215] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e40290 [0026.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0026.216] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0026.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0026.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0026.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0026.216] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin", lpFilePart=0x0) returned 0xf [0026.216] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\", lpFilePart=0x0) returned 0x10 [0026.216] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e40290 [0026.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0026.217] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0026.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0026.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0026.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0026.217] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e [0026.217] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f [0026.217] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e40290 [0026.217] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0026.217] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0026.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0026.218] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0026.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0026.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0026.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0026.218] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x3e [0026.218] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x3f [0026.218] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e40290 [0026.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0026.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0026.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0026.219] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0026.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0026.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0026.374] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0026.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0026.374] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x21c [0026.376] GetFileType (hFile=0x21c) returned 0x1 [0026.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0026.376] GetFileType (hFile=0x21c) returned 0x1 [0026.397] WriteFile (in: hFile=0x21c, lpBuffer=0x2229b70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2229b70*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0026.399] CloseHandle (hObject=0x21c) returned 1 [0026.421] EtwEventRegister (in: ProviderId=0x222b130, EnableCallback=0x1aff163c, CallbackContext=0x0, RegHandle=0x222b110 | out: RegHandle=0x222b110) returned 0x0 [0026.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe.config", nBufferLength=0x105, lpBuffer=0x2ed7c0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe.config", lpFilePart=0x0) returned 0x35 [0026.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc80) returned 1 [0026.427] GetFileAttributesExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Tron.exe.config" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\tron.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x2edd60 | out: lpFileInformation=0x2edd60*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0 [0026.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0026.972] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png", lpFilePart=0x0) returned 0x47 [0026.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0026.972] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0026.973] GetFileType (hFile=0x228) returned 0x1 [0026.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0026.973] GetFileType (hFile=0x228) returned 0x1 [0026.973] WriteFile (in: hFile=0x228, lpBuffer=0x222e488*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x222e488*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0026.974] CloseHandle (hObject=0x228) returned 1 [0026.977] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0026.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0026.977] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0026.978] GetFileType (hFile=0x228) returned 0x1 [0026.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0026.978] GetFileType (hFile=0x228) returned 0x1 [0026.978] WriteFile (in: hFile=0x228, lpBuffer=0x2232660*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x2232660*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0026.978] CloseHandle (hObject=0x228) returned 1 [0026.979] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0026.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0026.979] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0026.979] GetFileType (hFile=0x228) returned 0x1 [0026.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0026.980] GetFileType (hFile=0x228) returned 0x1 [0026.980] WriteFile (in: hFile=0x228, lpBuffer=0x2235080*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2235080*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0026.980] CloseHandle (hObject=0x228) returned 1 [0026.983] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Hack.TXT", lpFilePart=0x0) returned 0x18 [0026.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0026.983] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Hack.TXT" (normalized: "c:\\$recycle.bin\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0026.984] GetFileType (hFile=0x228) returned 0x1 [0026.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0026.984] GetFileType (hFile=0x228) returned 0x1 [0026.985] WriteFile (in: hFile=0x228, lpBuffer=0x223f2d8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x223f2d8*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0026.986] CloseHandle (hObject=0x228) returned 1 [0026.987] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Hack.png", lpFilePart=0x0) returned 0x18 [0026.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0026.987] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Hack.png" (normalized: "c:\\$recycle.bin\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0026.987] GetFileType (hFile=0x228) returned 0x1 [0026.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0026.987] GetFileType (hFile=0x228) returned 0x1 [0026.987] WriteFile (in: hFile=0x228, lpBuffer=0x2240340*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x2240340*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0026.988] CloseHandle (hObject=0x228) returned 1 [0026.988] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\Hack.vbs", lpFilePart=0x0) returned 0x18 [0026.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0026.988] CreateFileW (lpFileName="C:\\$Recycle.Bin\\Hack.vbs" (normalized: "c:\\$recycle.bin\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0026.988] GetFileType (hFile=0x228) returned 0x1 [0026.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0026.989] GetFileType (hFile=0x228) returned 0x1 [0026.989] WriteFile (in: hFile=0x228, lpBuffer=0x2243df0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x2243df0*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0026.989] CloseHandle (hObject=0x228) returned 1 [0026.989] GetFullPathNameW (in: lpFileName="C:\\$Recycle.Bin\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\$Recycle.Bin\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x44 [0026.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0026.990] CreateFileW (lpFileName="C:\\$Recycle.Bin\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\$recycle.bin\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0026.991] GetFileType (hFile=0x228) returned 0x1 [0026.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0026.991] GetFileType (hFile=0x228) returned 0x1 [0026.991] WriteFile (in: hFile=0x228, lpBuffer=0x2246760*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2246760*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0026.992] CloseHandle (hObject=0x228) returned 1 [0026.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0026.992] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0026.992] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0026.992] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e406b0 [0026.992] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.993] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.994] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.995] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.996] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.996] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.996] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.996] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.996] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.996] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0026.996] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0026.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0026.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0026.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0026.996] GetFullPathNameW (in: lpFileName="C:\\Boot", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Boot", lpFilePart=0x0) returned 0x7 [0026.996] GetFullPathNameW (in: lpFileName="C:\\Boot\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\", lpFilePart=0x0) returned 0x8 [0026.996] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e406b0 [0026.997] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.997] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.997] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.997] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.997] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.997] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.998] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0026.999] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.000] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.000] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.000] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.000] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.000] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0027.000] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0027.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0027.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.000] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0027.000] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0027.000] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.002] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.002] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ", lpFilePart=0x0) returned 0xd [0027.002] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\", lpFilePart=0x0) returned 0xe [0027.002] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.002] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.002] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.002] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.003] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.004] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.004] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\Hack.TXT" (normalized: "c:\\boot\\cs-cz\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.004] GetFileType (hFile=0x228) returned 0x1 [0027.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.004] GetFileType (hFile=0x228) returned 0x1 [0027.005] WriteFile (in: hFile=0x228, lpBuffer=0x2257320*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2257320*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.005] CloseHandle (hObject=0x228) returned 1 [0027.006] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.006] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\Hack.png" (normalized: "c:\\boot\\cs-cz\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.006] GetFileType (hFile=0x228) returned 0x1 [0027.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.006] GetFileType (hFile=0x228) returned 0x1 [0027.006] WriteFile (in: hFile=0x228, lpBuffer=0x2258380*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2258380*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0027.007] CloseHandle (hObject=0x228) returned 1 [0027.007] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.007] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\Hack.vbs" (normalized: "c:\\boot\\cs-cz\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.007] GetFileType (hFile=0x228) returned 0x1 [0027.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.008] GetFileType (hFile=0x228) returned 0x1 [0027.008] WriteFile (in: hFile=0x228, lpBuffer=0x225be18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x225be18*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0027.008] CloseHandle (hObject=0x228) returned 1 [0027.008] GetFullPathNameW (in: lpFileName="C:\\Boot\\cs-CZ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\cs-CZ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.009] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\cs-cz\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.010] GetFileType (hFile=0x228) returned 0x1 [0027.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.010] GetFileType (hFile=0x228) returned 0x1 [0027.010] WriteFile (in: hFile=0x228, lpBuffer=0x225e778*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x225e778*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.011] CloseHandle (hObject=0x228) returned 1 [0027.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.011] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0027.011] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0027.011] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.012] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.012] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.012] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.012] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.012] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK", lpFilePart=0x0) returned 0xd [0027.012] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\", lpFilePart=0x0) returned 0xe [0027.012] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.013] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.013] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.013] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.013] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.013] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.014] CreateFileW (lpFileName="C:\\Boot\\da-DK\\Hack.TXT" (normalized: "c:\\boot\\da-dk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.014] GetFileType (hFile=0x228) returned 0x1 [0027.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.014] GetFileType (hFile=0x228) returned 0x1 [0027.014] WriteFile (in: hFile=0x228, lpBuffer=0x226a298*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x226a298*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.015] CloseHandle (hObject=0x228) returned 1 [0027.015] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.015] CreateFileW (lpFileName="C:\\Boot\\da-DK\\Hack.png" (normalized: "c:\\boot\\da-dk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.016] GetFileType (hFile=0x228) returned 0x1 [0027.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.016] GetFileType (hFile=0x228) returned 0x1 [0027.016] WriteFile (in: hFile=0x228, lpBuffer=0x226b2f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x226b2f8*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0027.017] CloseHandle (hObject=0x228) returned 1 [0027.017] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.017] CreateFileW (lpFileName="C:\\Boot\\da-DK\\Hack.vbs" (normalized: "c:\\boot\\da-dk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.017] GetFileType (hFile=0x228) returned 0x1 [0027.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.017] GetFileType (hFile=0x228) returned 0x1 [0027.017] WriteFile (in: hFile=0x228, lpBuffer=0x226ed90*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x226ed90*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0027.018] CloseHandle (hObject=0x228) returned 1 [0027.019] GetFullPathNameW (in: lpFileName="C:\\Boot\\da-DK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\da-DK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.019] CreateFileW (lpFileName="C:\\Boot\\da-DK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\da-dk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.020] GetFileType (hFile=0x228) returned 0x1 [0027.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.020] GetFileType (hFile=0x228) returned 0x1 [0027.021] WriteFile (in: hFile=0x228, lpBuffer=0x22716f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22716f0*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.022] CloseHandle (hObject=0x228) returned 1 [0027.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.022] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0027.022] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0027.022] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.023] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.023] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.023] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.023] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.023] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE", lpFilePart=0x0) returned 0xd [0027.023] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\", lpFilePart=0x0) returned 0xe [0027.024] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.024] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.024] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.024] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.024] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.024] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.025] CreateFileW (lpFileName="C:\\Boot\\de-DE\\Hack.TXT" (normalized: "c:\\boot\\de-de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.025] GetFileType (hFile=0x228) returned 0x1 [0027.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.025] GetFileType (hFile=0x228) returned 0x1 [0027.025] WriteFile (in: hFile=0x228, lpBuffer=0x227d210*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x227d210*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.026] CloseHandle (hObject=0x228) returned 1 [0027.027] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.027] CreateFileW (lpFileName="C:\\Boot\\de-DE\\Hack.png" (normalized: "c:\\boot\\de-de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.027] GetFileType (hFile=0x228) returned 0x1 [0027.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.027] GetFileType (hFile=0x228) returned 0x1 [0027.027] WriteFile (in: hFile=0x228, lpBuffer=0x227e270*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x227e270*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0027.028] CloseHandle (hObject=0x228) returned 1 [0027.028] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.028] CreateFileW (lpFileName="C:\\Boot\\de-DE\\Hack.vbs" (normalized: "c:\\boot\\de-de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.028] GetFileType (hFile=0x228) returned 0x1 [0027.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.028] GetFileType (hFile=0x228) returned 0x1 [0027.029] WriteFile (in: hFile=0x228, lpBuffer=0x2281d08*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x2281d08*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0027.029] CloseHandle (hObject=0x228) returned 1 [0027.030] GetFullPathNameW (in: lpFileName="C:\\Boot\\de-DE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\de-DE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.030] CreateFileW (lpFileName="C:\\Boot\\de-DE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\de-de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.031] GetFileType (hFile=0x228) returned 0x1 [0027.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.031] GetFileType (hFile=0x228) returned 0x1 [0027.031] WriteFile (in: hFile=0x228, lpBuffer=0x2284668*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2284668*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.032] CloseHandle (hObject=0x228) returned 1 [0027.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.032] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0027.032] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0027.032] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.033] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.033] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.033] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.033] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.038] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR", lpFilePart=0x0) returned 0xd [0027.038] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\", lpFilePart=0x0) returned 0xe [0027.038] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.038] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.038] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.038] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.038] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.038] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.039] CreateFileW (lpFileName="C:\\Boot\\el-GR\\Hack.TXT" (normalized: "c:\\boot\\el-gr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.041] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.041] CreateFileW (lpFileName="C:\\Boot\\el-GR\\Hack.png" (normalized: "c:\\boot\\el-gr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.042] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.043] CreateFileW (lpFileName="C:\\Boot\\el-GR\\Hack.vbs" (normalized: "c:\\boot\\el-gr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.044] GetFullPathNameW (in: lpFileName="C:\\Boot\\el-GR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\el-GR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.044] CreateFileW (lpFileName="C:\\Boot\\el-GR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\el-gr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.046] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0027.046] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0027.046] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.047] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.047] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.047] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.047] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.047] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.048] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US", lpFilePart=0x0) returned 0xd [0027.048] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\", lpFilePart=0x0) returned 0xe [0027.048] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.048] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.048] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.048] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.048] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.048] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.049] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.049] CreateFileW (lpFileName="C:\\Boot\\en-US\\Hack.TXT" (normalized: "c:\\boot\\en-us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.050] WriteFile (in: hFile=0x228, lpBuffer=0x22a3410*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22a3410*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.051] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.051] CreateFileW (lpFileName="C:\\Boot\\en-US\\Hack.png" (normalized: "c:\\boot\\en-us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.052] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.052] CreateFileW (lpFileName="C:\\Boot\\en-US\\Hack.vbs" (normalized: "c:\\boot\\en-us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.054] GetFullPathNameW (in: lpFileName="C:\\Boot\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.054] CreateFileW (lpFileName="C:\\Boot\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\en-us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.056] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0027.056] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0027.056] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.057] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.057] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.057] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.057] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.057] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES", lpFilePart=0x0) returned 0xd [0027.057] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\", lpFilePart=0x0) returned 0xe [0027.057] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.057] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.058] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.058] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.058] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.058] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.058] CreateFileW (lpFileName="C:\\Boot\\es-ES\\Hack.TXT" (normalized: "c:\\boot\\es-es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.060] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.060] CreateFileW (lpFileName="C:\\Boot\\es-ES\\Hack.png" (normalized: "c:\\boot\\es-es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.061] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.061] CreateFileW (lpFileName="C:\\Boot\\es-ES\\Hack.vbs" (normalized: "c:\\boot\\es-es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.062] GetFullPathNameW (in: lpFileName="C:\\Boot\\es-ES\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\es-ES\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.062] CreateFileW (lpFileName="C:\\Boot\\es-ES\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\es-es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.064] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0027.064] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0027.064] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.065] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.065] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.065] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.065] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.065] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI", lpFilePart=0x0) returned 0xd [0027.065] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\", lpFilePart=0x0) returned 0xe [0027.065] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.065] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.066] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.066] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.066] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.066] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.066] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\Hack.TXT" (normalized: "c:\\boot\\fi-fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.068] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.068] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\Hack.png" (normalized: "c:\\boot\\fi-fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.069] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.069] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\Hack.vbs" (normalized: "c:\\boot\\fi-fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.070] GetFullPathNameW (in: lpFileName="C:\\Boot\\fi-FI\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fi-FI\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.070] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\fi-fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.072] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0027.072] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0027.072] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.073] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.073] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts", lpFilePart=0x0) returned 0xd [0027.073] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\", lpFilePart=0x0) returned 0xe [0027.073] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.074] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.074] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.074] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.074] CreateFileW (lpFileName="C:\\Boot\\Fonts\\Hack.TXT" (normalized: "c:\\boot\\fonts\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.077] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.077] CreateFileW (lpFileName="C:\\Boot\\Fonts\\Hack.png" (normalized: "c:\\boot\\fonts\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.078] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.078] CreateFileW (lpFileName="C:\\Boot\\Fonts\\Hack.vbs" (normalized: "c:\\boot\\fonts\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.079] WriteFile (in: hFile=0x228, lpBuffer=0x22e17a8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x22e17a8*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0027.079] GetFullPathNameW (in: lpFileName="C:\\Boot\\Fonts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Fonts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.079] CreateFileW (lpFileName="C:\\Boot\\Fonts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\fonts\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.081] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0027.081] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0027.081] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.082] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.082] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.082] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.082] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.082] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR", lpFilePart=0x0) returned 0xd [0027.082] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\", lpFilePart=0x0) returned 0xe [0027.082] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.082] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.082] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.083] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.083] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.083] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.083] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\Hack.TXT" (normalized: "c:\\boot\\fr-fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.085] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.085] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\Hack.png" (normalized: "c:\\boot\\fr-fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.086] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.086] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\Hack.vbs" (normalized: "c:\\boot\\fr-fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.087] GetFullPathNameW (in: lpFileName="C:\\Boot\\fr-FR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\fr-FR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.087] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\fr-fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.089] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0027.089] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0027.089] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.090] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.090] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.090] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.090] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.090] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU", lpFilePart=0x0) returned 0xd [0027.090] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\", lpFilePart=0x0) returned 0xe [0027.090] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.090] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.090] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.090] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.090] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.091] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.091] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\Hack.TXT" (normalized: "c:\\boot\\hu-hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.092] WriteFile (in: hFile=0x228, lpBuffer=0x2302ba0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2302ba0*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.093] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.093] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\Hack.png" (normalized: "c:\\boot\\hu-hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.097] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.097] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\Hack.vbs" (normalized: "c:\\boot\\hu-hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.098] GetFullPathNameW (in: lpFileName="C:\\Boot\\hu-HU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\hu-HU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.099] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\hu-hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.102] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0027.102] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0027.102] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.104] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.104] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.104] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.104] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.104] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT", lpFilePart=0x0) returned 0xd [0027.105] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\", lpFilePart=0x0) returned 0xe [0027.105] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.105] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.105] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.105] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.105] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.106] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.106] CreateFileW (lpFileName="C:\\Boot\\it-IT\\Hack.TXT" (normalized: "c:\\boot\\it-it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.107] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.107] CreateFileW (lpFileName="C:\\Boot\\it-IT\\Hack.png" (normalized: "c:\\boot\\it-it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.109] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.109] CreateFileW (lpFileName="C:\\Boot\\it-IT\\Hack.vbs" (normalized: "c:\\boot\\it-it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.110] GetFullPathNameW (in: lpFileName="C:\\Boot\\it-IT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\it-IT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.110] CreateFileW (lpFileName="C:\\Boot\\it-IT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\it-it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.113] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0027.113] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0027.113] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.113] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.113] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.113] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.113] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.114] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP", lpFilePart=0x0) returned 0xd [0027.114] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\", lpFilePart=0x0) returned 0xe [0027.114] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.114] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.114] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.114] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.114] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.115] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.115] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\Hack.TXT" (normalized: "c:\\boot\\ja-jp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.116] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.116] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\Hack.png" (normalized: "c:\\boot\\ja-jp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.118] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.118] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\Hack.vbs" (normalized: "c:\\boot\\ja-jp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.119] GetFullPathNameW (in: lpFileName="C:\\Boot\\ja-JP\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ja-JP\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.119] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\ja-jp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.122] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0027.122] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0027.122] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.123] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.123] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.123] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.123] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.123] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR", lpFilePart=0x0) returned 0xd [0027.124] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\", lpFilePart=0x0) returned 0xe [0027.124] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.124] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.124] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.124] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\Hack.TXT" (normalized: "c:\\boot\\ko-kr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.126] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.126] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\Hack.png" (normalized: "c:\\boot\\ko-kr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.127] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.127] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\Hack.vbs" (normalized: "c:\\boot\\ko-kr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.128] GetFullPathNameW (in: lpFileName="C:\\Boot\\ko-KR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ko-KR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.129] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\ko-kr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.131] WriteFile (in: hFile=0x228, lpBuffer=0x2342e60*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2342e60*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.132] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0027.132] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0027.132] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.132] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.132] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.132] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.133] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.133] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO", lpFilePart=0x0) returned 0xd [0027.133] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\", lpFilePart=0x0) returned 0xe [0027.133] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.133] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.133] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.133] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.133] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.133] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.134] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\Hack.TXT" (normalized: "c:\\boot\\nb-no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.135] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.135] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\Hack.png" (normalized: "c:\\boot\\nb-no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.137] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.137] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\Hack.vbs" (normalized: "c:\\boot\\nb-no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.138] GetFullPathNameW (in: lpFileName="C:\\Boot\\nb-NO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nb-NO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.138] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\nb-no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.141] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0027.141] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0027.141] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.142] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.142] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.142] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.142] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.143] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL", lpFilePart=0x0) returned 0xd [0027.143] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\", lpFilePart=0x0) returned 0xe [0027.143] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.143] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.143] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.143] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.143] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.143] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.143] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\Hack.TXT" (normalized: "c:\\boot\\nl-nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.144] WriteFile (in: hFile=0x228, lpBuffer=0x23618f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x23618f8*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.145] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.145] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\Hack.png" (normalized: "c:\\boot\\nl-nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.147] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.147] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\Hack.vbs" (normalized: "c:\\boot\\nl-nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.148] GetFullPathNameW (in: lpFileName="C:\\Boot\\nl-NL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\nl-NL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.148] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\nl-nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.151] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0027.151] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0027.152] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.152] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.152] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.152] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.152] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.152] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL", lpFilePart=0x0) returned 0xd [0027.152] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\", lpFilePart=0x0) returned 0xe [0027.152] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.152] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.153] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.153] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.153] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.153] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.153] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\Hack.TXT" (normalized: "c:\\boot\\pl-pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.155] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.155] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\Hack.png" (normalized: "c:\\boot\\pl-pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.156] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.157] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\Hack.vbs" (normalized: "c:\\boot\\pl-pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.158] GetFullPathNameW (in: lpFileName="C:\\Boot\\pl-PL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pl-PL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.158] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\pl-pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.161] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0027.161] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0027.161] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.162] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.162] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.162] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.162] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.162] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR", lpFilePart=0x0) returned 0xd [0027.162] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\", lpFilePart=0x0) returned 0xe [0027.162] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.162] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.163] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.163] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.163] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.164] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.164] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\Hack.TXT" (normalized: "c:\\boot\\pt-br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.165] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.165] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\Hack.png" (normalized: "c:\\boot\\pt-br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.170] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.170] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\Hack.vbs" (normalized: "c:\\boot\\pt-br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.171] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.171] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\pt-br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.175] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0027.175] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0027.175] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.175] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.175] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.175] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.175] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.176] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT", lpFilePart=0x0) returned 0xd [0027.176] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\", lpFilePart=0x0) returned 0xe [0027.176] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.176] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.176] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.176] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.176] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.177] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.177] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\Hack.TXT" (normalized: "c:\\boot\\pt-pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.178] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.178] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\Hack.png" (normalized: "c:\\boot\\pt-pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.181] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.181] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\Hack.vbs" (normalized: "c:\\boot\\pt-pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.182] GetFullPathNameW (in: lpFileName="C:\\Boot\\pt-PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\pt-PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.183] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\pt-pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.186] WriteFile (in: hFile=0x228, lpBuffer=0x23a1bb8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x23a1bb8*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.187] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0027.187] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0027.187] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.189] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.189] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.189] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.189] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.189] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU", lpFilePart=0x0) returned 0xd [0027.189] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\", lpFilePart=0x0) returned 0xe [0027.189] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.189] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.189] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.189] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.190] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.190] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.190] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\Hack.TXT" (normalized: "c:\\boot\\ru-ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.199] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.199] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\Hack.png" (normalized: "c:\\boot\\ru-ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.202] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.202] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\Hack.vbs" (normalized: "c:\\boot\\ru-ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.203] GetFullPathNameW (in: lpFileName="C:\\Boot\\ru-RU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\ru-RU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.203] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\ru-ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.207] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0027.207] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0027.207] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.207] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.207] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.208] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.208] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.208] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE", lpFilePart=0x0) returned 0xd [0027.208] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\", lpFilePart=0x0) returned 0xe [0027.208] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.208] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.208] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.208] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.208] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.209] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.209] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\Hack.TXT" (normalized: "c:\\boot\\sv-se\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.210] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.211] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\Hack.png" (normalized: "c:\\boot\\sv-se\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.213] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.213] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\Hack.vbs" (normalized: "c:\\boot\\sv-se\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.214] GetFullPathNameW (in: lpFileName="C:\\Boot\\sv-SE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\sv-SE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.214] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\sv-se\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.218] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0027.218] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0027.218] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.219] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.219] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.219] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.219] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.219] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR", lpFilePart=0x0) returned 0xd [0027.219] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\", lpFilePart=0x0) returned 0xe [0027.219] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.219] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.219] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.219] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.219] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.220] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.220] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\Hack.TXT" (normalized: "c:\\boot\\tr-tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.221] WriteFile (in: hFile=0x228, lpBuffer=0x23d35c8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x23d35c8*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.222] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.223] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\Hack.png" (normalized: "c:\\boot\\tr-tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.225] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.225] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\Hack.vbs" (normalized: "c:\\boot\\tr-tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.226] GetFullPathNameW (in: lpFileName="C:\\Boot\\tr-TR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\tr-TR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.226] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\tr-tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.230] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0027.230] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0027.230] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.230] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.231] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.231] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN", lpFilePart=0x0) returned 0xd [0027.231] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\", lpFilePart=0x0) returned 0xe [0027.231] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.231] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.232] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.232] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\Hack.TXT" (normalized: "c:\\boot\\zh-cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.236] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.236] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\Hack.png" (normalized: "c:\\boot\\zh-cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.239] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.239] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\Hack.vbs" (normalized: "c:\\boot\\zh-cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.240] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.240] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\zh-cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.244] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0027.244] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0027.244] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.245] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.245] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.245] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.245] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.245] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK", lpFilePart=0x0) returned 0xd [0027.245] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\", lpFilePart=0x0) returned 0xe [0027.245] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.245] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.245] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.245] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.245] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.246] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.246] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\Hack.TXT" (normalized: "c:\\boot\\zh-hk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.248] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.248] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\Hack.png" (normalized: "c:\\boot\\zh-hk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.250] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.250] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\Hack.vbs" (normalized: "c:\\boot\\zh-hk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.251] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-HK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-HK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.251] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\zh-hk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.255] WriteFile (in: hFile=0x228, lpBuffer=0x2400910*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2400910*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.256] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0027.321] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0027.322] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.322] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.322] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.322] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.322] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.323] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW", lpFilePart=0x0) returned 0xd [0027.323] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\", lpFilePart=0x0) returned 0xe [0027.323] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.323] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.323] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.323] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.323] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.325] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.326] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\Hack.TXT" (normalized: "c:\\boot\\zh-tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.326] GetFileType (hFile=0x228) returned 0x1 [0027.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.326] GetFileType (hFile=0x228) returned 0x1 [0027.326] WriteFile (in: hFile=0x228, lpBuffer=0x221f7e0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x221f7e0*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0027.327] CloseHandle (hObject=0x228) returned 1 [0027.327] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0027.327] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\Hack.png" (normalized: "c:\\boot\\zh-tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.329] GetFileType (hFile=0x228) returned 0x1 [0027.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0027.329] GetFileType (hFile=0x228) returned 0x1 [0027.329] WriteFile (in: hFile=0x228, lpBuffer=0x2220840*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2220840*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0027.333] CloseHandle (hObject=0x228) returned 1 [0027.333] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.333] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\Hack.vbs" (normalized: "c:\\boot\\zh-tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.333] GetFileType (hFile=0x228) returned 0x1 [0027.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.333] GetFileType (hFile=0x228) returned 0x1 [0027.333] WriteFile (in: hFile=0x228, lpBuffer=0x22242d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x22242d8*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0027.334] CloseHandle (hObject=0x228) returned 1 [0027.334] GetFullPathNameW (in: lpFileName="C:\\Boot\\zh-TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\zh-TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0027.334] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\zh-tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.336] GetFileType (hFile=0x228) returned 0x1 [0027.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0027.336] GetFileType (hFile=0x228) returned 0x1 [0027.336] WriteFile (in: hFile=0x228, lpBuffer=0x2226c38*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2226c38*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0027.337] CloseHandle (hObject=0x228) returned 1 [0027.339] GetFullPathNameW (in: lpFileName="C:\\Boot\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Hack.TXT", lpFilePart=0x0) returned 0x10 [0027.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.339] CreateFileW (lpFileName="C:\\Boot\\Hack.TXT" (normalized: "c:\\boot\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.339] GetFileType (hFile=0x228) returned 0x1 [0027.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.339] GetFileType (hFile=0x228) returned 0x1 [0027.340] WriteFile (in: hFile=0x228, lpBuffer=0x2230e70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2230e70*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0027.341] CloseHandle (hObject=0x228) returned 1 [0027.341] GetFullPathNameW (in: lpFileName="C:\\Boot\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Hack.png", lpFilePart=0x0) returned 0x10 [0027.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0027.341] CreateFileW (lpFileName="C:\\Boot\\Hack.png" (normalized: "c:\\boot\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.342] GetFileType (hFile=0x228) returned 0x1 [0027.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0027.342] GetFileType (hFile=0x228) returned 0x1 [0027.342] WriteFile (in: hFile=0x228, lpBuffer=0x2231ec8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x2231ec8*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0027.343] CloseHandle (hObject=0x228) returned 1 [0027.343] GetFullPathNameW (in: lpFileName="C:\\Boot\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\Hack.vbs", lpFilePart=0x0) returned 0x10 [0027.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.343] CreateFileW (lpFileName="C:\\Boot\\Hack.vbs" (normalized: "c:\\boot\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.343] GetFileType (hFile=0x228) returned 0x1 [0027.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.343] GetFileType (hFile=0x228) returned 0x1 [0027.344] WriteFile (in: hFile=0x228, lpBuffer=0x2235948*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x2235948*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0027.344] CloseHandle (hObject=0x228) returned 1 [0027.344] GetFullPathNameW (in: lpFileName="C:\\Boot\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Boot\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x3c [0027.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.344] CreateFileW (lpFileName="C:\\Boot\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\boot\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.346] GetFileType (hFile=0x228) returned 0x1 [0027.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.346] GetFileType (hFile=0x228) returned 0x1 [0027.346] WriteFile (in: hFile=0x228, lpBuffer=0x2238298*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2238298*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0027.347] CloseHandle (hObject=0x228) returned 1 [0027.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0027.347] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0027.347] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0027.347] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e406b0 [0027.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0027.348] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0027.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0027.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0027.348] GetFullPathNameW (in: lpFileName="C:\\Config.Msi", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi", lpFilePart=0x0) returned 0xd [0027.348] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\", lpFilePart=0x0) returned 0xe [0027.348] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e406b0 [0027.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0027.349] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0027.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0027.349] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\Hack.TXT", lpFilePart=0x0) returned 0x16 [0027.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.349] CreateFileW (lpFileName="C:\\Config.Msi\\Hack.TXT" (normalized: "c:\\config.msi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.350] GetFileType (hFile=0x228) returned 0x1 [0027.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.350] GetFileType (hFile=0x228) returned 0x1 [0027.350] WriteFile (in: hFile=0x228, lpBuffer=0x2243a40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2243a40*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0027.351] CloseHandle (hObject=0x228) returned 1 [0027.351] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\Hack.png", lpFilePart=0x0) returned 0x16 [0027.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0027.351] CreateFileW (lpFileName="C:\\Config.Msi\\Hack.png" (normalized: "c:\\config.msi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.352] GetFileType (hFile=0x228) returned 0x1 [0027.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0027.352] GetFileType (hFile=0x228) returned 0x1 [0027.352] WriteFile (in: hFile=0x228, lpBuffer=0x2244aa0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x2244aa0*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0027.353] CloseHandle (hObject=0x228) returned 1 [0027.353] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\Hack.vbs", lpFilePart=0x0) returned 0x16 [0027.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.354] CreateFileW (lpFileName="C:\\Config.Msi\\Hack.vbs" (normalized: "c:\\config.msi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.354] GetFileType (hFile=0x228) returned 0x1 [0027.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.354] GetFileType (hFile=0x228) returned 0x1 [0027.354] WriteFile (in: hFile=0x228, lpBuffer=0x2248538*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x2248538*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0027.355] CloseHandle (hObject=0x228) returned 1 [0027.355] GetFullPathNameW (in: lpFileName="C:\\Config.Msi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Config.Msi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x42 [0027.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.355] CreateFileW (lpFileName="C:\\Config.Msi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\config.msi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.357] GetFileType (hFile=0x228) returned 0x1 [0027.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.357] GetFileType (hFile=0x228) returned 0x1 [0027.357] WriteFile (in: hFile=0x228, lpBuffer=0x224ae98*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x224ae98*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0027.359] CloseHandle (hObject=0x228) returned 1 [0027.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0027.359] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings", lpFilePart=0x0) returned 0x19 [0027.359] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\", lpFilePart=0x0) returned 0x1a [0027.359] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0xffffffffffffffff [0027.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfc0) returned 1 [0027.424] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\Hack.TXT", lpFilePart=0x0) returned 0x22 [0027.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.424] CreateFileW (lpFileName="C:\\Documents and Settings\\Hack.TXT" (normalized: "c:\\documents and settings\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.425] GetFileType (hFile=0x228) returned 0x1 [0027.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.425] GetFileType (hFile=0x228) returned 0x1 [0027.425] WriteFile (in: hFile=0x228, lpBuffer=0x2259cb0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2259cb0*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0027.426] CloseHandle (hObject=0x228) returned 1 [0027.426] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\Hack.png", lpFilePart=0x0) returned 0x22 [0027.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0027.426] CreateFileW (lpFileName="C:\\Documents and Settings\\Hack.png" (normalized: "c:\\documents and settings\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.430] GetFileType (hFile=0x228) returned 0x1 [0027.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0027.430] GetFileType (hFile=0x228) returned 0x1 [0027.430] WriteFile (in: hFile=0x228, lpBuffer=0x225ad28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x225ad28*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0027.431] CloseHandle (hObject=0x228) returned 1 [0027.431] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\Hack.vbs", lpFilePart=0x0) returned 0x22 [0027.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.431] CreateFileW (lpFileName="C:\\Documents and Settings\\Hack.vbs" (normalized: "c:\\documents and settings\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.431] GetFileType (hFile=0x228) returned 0x1 [0027.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.431] GetFileType (hFile=0x228) returned 0x1 [0027.431] WriteFile (in: hFile=0x228, lpBuffer=0x225e808*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x225e808*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0027.432] CloseHandle (hObject=0x228) returned 1 [0027.432] GetFullPathNameW (in: lpFileName="C:\\Documents and Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Documents and Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4e [0027.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0027.432] CreateFileW (lpFileName="C:\\Documents and Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\documents and settings\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0027.434] GetFileType (hFile=0x228) returned 0x1 [0027.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0027.434] GetFileType (hFile=0x228) returned 0x1 [0027.434] WriteFile (in: hFile=0x228, lpBuffer=0x2261198*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2261198*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0027.434] CloseHandle (hObject=0x228) returned 1 [0027.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0027.435] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0027.435] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0027.435] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e406b0 [0027.435] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.435] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.435] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0027.435] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0027.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0027.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0027.436] GetFullPathNameW (in: lpFileName="C:\\MSOCache", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache", lpFilePart=0x0) returned 0xb [0027.436] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\", lpFilePart=0x0) returned 0xc [0027.436] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x1e406b0 [0027.436] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.436] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0027.436] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0027.436] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0027.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0027.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.436] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0027.436] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0027.436] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.454] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.455] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.456] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.457] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.457] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.457] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0027.458] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users", lpFilePart=0x0) returned 0x15 [0027.458] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\", lpFilePart=0x0) returned 0x16 [0027.458] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x1e406b0 [0027.458] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.459] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.460] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0027.461] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0027.461] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0027.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0027.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0027.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0027.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0027.462] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0027.463] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.463] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.463] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.463] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.463] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.464] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0027.464] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0027.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0027.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0027.464] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0027.464] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0027.464] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0027.464] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.464] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.464] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.464] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.464] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0027.465] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0027.465] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0027.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0027.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0027.465] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0027.465] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", dwFileAttributes=0x80) returned 1 [0027.868] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.Horsuke", lpFilePart=0x0) returned 0x53 [0027.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0027.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0027.870] GetFileType (hFile=0x228) returned 0x1 [0027.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0027.870] GetFileType (hFile=0x228) returned 0x1 [0027.939] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x2edf90 | out: pfEnabled=0x2edf90) returned 0x0 [0028.610] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0028.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0028.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0028.610] GetFileType (hFile=0x23c) returned 0x1 [0028.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0028.610] GetFileType (hFile=0x23c) returned 0x1 [0028.610] ReadFile (in: hFile=0x23c, lpBuffer=0x235a2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235a2f8*, lpNumberOfBytesRead=0x2edf68*=0x61d, lpOverlapped=0x0) returned 1 [0028.621] ReadFile (in: hFile=0x23c, lpBuffer=0x235a0fd, nNumberOfBytesToRead=0x1e3, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235a0fd*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0028.622] ReadFile (in: hFile=0x23c, lpBuffer=0x235a2f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235a2f8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0028.622] CloseHandle (hObject=0x23c) returned 1 [0028.622] WriteFile (in: hFile=0x228, lpBuffer=0x23545e8*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23545e8*, lpNumberOfBytesWritten=0x2ede38*=0x640, lpOverlapped=0x0) returned 1 [0028.623] CloseHandle (hObject=0x228) returned 1 [0028.624] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml", lpFilePart=0x0) returned 0x4b [0028.624] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0028.625] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0028.625] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0028.626] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0028.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0028.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0028.627] GetFileType (hFile=0x228) returned 0x1 [0028.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0028.627] GetFileType (hFile=0x228) returned 0x1 [0029.116] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0029.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0029.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0029.116] GetFileType (hFile=0x23c) returned 0x1 [0029.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0029.116] GetFileType (hFile=0x23c) returned 0x1 [0029.117] ReadFile (in: hFile=0x23c, lpBuffer=0x2247488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2247488*, lpNumberOfBytesRead=0x2edf68*=0x8f8, lpOverlapped=0x0) returned 1 [0029.134] ReadFile (in: hFile=0x23c, lpBuffer=0x2247168, nNumberOfBytesToRead=0x308, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2247168*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0029.134] ReadFile (in: hFile=0x23c, lpBuffer=0x2247488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2247488*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0029.134] CloseHandle (hObject=0x23c) returned 1 [0029.134] WriteFile (in: hFile=0x228, lpBuffer=0x2245988*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2245988*, lpNumberOfBytesWritten=0x2ede38*=0x920, lpOverlapped=0x0) returned 1 [0029.135] CloseHandle (hObject=0x228) returned 1 [0029.136] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0029.136] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0029.139] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0029.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0029.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0029.140] GetFileType (hFile=0x228) returned 0x1 [0029.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0029.140] GetFileType (hFile=0x228) returned 0x1 [0029.140] WriteFile (in: hFile=0x228, lpBuffer=0x22521e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22521e8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0029.141] CloseHandle (hObject=0x228) returned 1 [0029.141] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0029.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0029.141] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0029.142] GetFileType (hFile=0x228) returned 0x1 [0029.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0029.142] GetFileType (hFile=0x228) returned 0x1 [0029.142] WriteFile (in: hFile=0x228, lpBuffer=0x22532a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22532a8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0029.143] CloseHandle (hObject=0x228) returned 1 [0029.143] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0029.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0029.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0029.144] GetFileType (hFile=0x228) returned 0x1 [0029.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0029.144] GetFileType (hFile=0x228) returned 0x1 [0029.144] WriteFile (in: hFile=0x228, lpBuffer=0x2256e60*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2256e60*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0029.144] CloseHandle (hObject=0x228) returned 1 [0029.145] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0029.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0029.145] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0029.145] GetFileType (hFile=0x228) returned 0x1 [0029.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0029.146] GetFileType (hFile=0x228) returned 0x1 [0029.146] WriteFile (in: hFile=0x228, lpBuffer=0x2259880*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2259880*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0029.146] CloseHandle (hObject=0x228) returned 1 [0029.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0029.147] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0029.147] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0029.147] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0029.157] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.157] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.158] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.158] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.158] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.158] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0029.158] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0029.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0029.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0029.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0029.159] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0029.159] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0029.159] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0029.160] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.160] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.160] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.160] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.160] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0029.160] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0029.160] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0029.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0029.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0029.161] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0029.161] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", dwFileAttributes=0x80) returned 1 [0029.163] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.Horsuke", lpFilePart=0x0) returned 0x58 [0029.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0029.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0029.163] GetFileType (hFile=0x228) returned 0x1 [0029.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0029.163] GetFileType (hFile=0x228) returned 0x1 [0029.667] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0029.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0029.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0029.667] GetFileType (hFile=0x23c) returned 0x1 [0029.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0029.667] GetFileType (hFile=0x23c) returned 0x1 [0029.667] ReadFile (in: hFile=0x23c, lpBuffer=0x2345aa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2345aa8*, lpNumberOfBytesRead=0x2edf68*=0x5aa, lpOverlapped=0x0) returned 1 [0029.674] ReadFile (in: hFile=0x23c, lpBuffer=0x234583a, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x234583a*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0029.674] ReadFile (in: hFile=0x23c, lpBuffer=0x2345aa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2345aa8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0029.674] CloseHandle (hObject=0x23c) returned 1 [0029.675] WriteFile (in: hFile=0x228, lpBuffer=0x2343f88*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2343f88*, lpNumberOfBytesWritten=0x2ede38*=0x5d0, lpOverlapped=0x0) returned 1 [0029.676] CloseHandle (hObject=0x228) returned 1 [0029.676] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml", lpFilePart=0x0) returned 0x50 [0029.676] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0029.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0029.677] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0029.678] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0029.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0029.678] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0029.679] GetFileType (hFile=0x228) returned 0x1 [0029.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0029.679] GetFileType (hFile=0x228) returned 0x1 [0030.289] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0030.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0030.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0030.290] GetFileType (hFile=0x23c) returned 0x1 [0030.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0030.290] GetFileType (hFile=0x23c) returned 0x1 [0030.290] ReadFile (in: hFile=0x23c, lpBuffer=0x222ea38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222ea38*, lpNumberOfBytesRead=0x2edf68*=0x75e, lpOverlapped=0x0) returned 1 [0030.293] ReadFile (in: hFile=0x23c, lpBuffer=0x222e97e, nNumberOfBytesToRead=0xa2, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222e97e*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0030.293] ReadFile (in: hFile=0x23c, lpBuffer=0x222ea38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222ea38*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0030.294] CloseHandle (hObject=0x23c) returned 1 [0030.294] WriteFile (in: hFile=0x228, lpBuffer=0x222cf38*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x222cf38*, lpNumberOfBytesWritten=0x2ede38*=0x780, lpOverlapped=0x0) returned 1 [0030.295] CloseHandle (hObject=0x228) returned 1 [0030.296] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0030.296] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0030.299] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0030.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0030.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0030.299] GetFileType (hFile=0x228) returned 0x1 [0030.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0030.299] GetFileType (hFile=0x228) returned 0x1 [0030.300] WriteFile (in: hFile=0x228, lpBuffer=0x22395e0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22395e0*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0030.300] CloseHandle (hObject=0x228) returned 1 [0030.301] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0030.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0030.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0030.301] GetFileType (hFile=0x228) returned 0x1 [0030.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0030.301] GetFileType (hFile=0x228) returned 0x1 [0030.301] WriteFile (in: hFile=0x228, lpBuffer=0x223a6a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x223a6a0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0030.302] CloseHandle (hObject=0x228) returned 1 [0030.302] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0030.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0030.302] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0030.309] GetFileType (hFile=0x228) returned 0x1 [0030.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0030.309] GetFileType (hFile=0x228) returned 0x1 [0030.309] WriteFile (in: hFile=0x228, lpBuffer=0x223e258*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x223e258*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0030.310] CloseHandle (hObject=0x228) returned 1 [0030.310] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0030.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0030.310] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0030.310] GetFileType (hFile=0x228) returned 0x1 [0030.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0030.310] GetFileType (hFile=0x228) returned 0x1 [0030.311] WriteFile (in: hFile=0x228, lpBuffer=0x2240c78*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2240c78*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0030.311] CloseHandle (hObject=0x228) returned 1 [0030.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0030.312] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0030.312] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0030.312] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0030.327] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.327] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.327] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.327] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.327] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.327] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0030.328] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0030.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0030.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0030.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0030.328] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0030.328] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0030.329] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0030.329] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.329] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.330] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.330] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.330] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0030.330] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0030.330] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0030.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0030.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0030.331] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0030.331] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", dwFileAttributes=0x80) returned 1 [0030.336] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.Horsuke", lpFilePart=0x0) returned 0x57 [0030.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0030.336] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0030.337] GetFileType (hFile=0x228) returned 0x1 [0030.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0030.337] GetFileType (hFile=0x228) returned 0x1 [0030.808] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0030.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0030.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0030.809] GetFileType (hFile=0x23c) returned 0x1 [0030.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0030.809] GetFileType (hFile=0x23c) returned 0x1 [0030.809] ReadFile (in: hFile=0x23c, lpBuffer=0x232ce58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x232ce58*, lpNumberOfBytesRead=0x2edf68*=0x5aa, lpOverlapped=0x0) returned 1 [0030.811] ReadFile (in: hFile=0x23c, lpBuffer=0x232cbea, nNumberOfBytesToRead=0x256, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x232cbea*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0030.812] ReadFile (in: hFile=0x23c, lpBuffer=0x232ce58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x232ce58*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0030.812] CloseHandle (hObject=0x23c) returned 1 [0030.812] WriteFile (in: hFile=0x228, lpBuffer=0x232b340*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x232b340*, lpNumberOfBytesWritten=0x2ede38*=0x5d0, lpOverlapped=0x0) returned 1 [0030.813] CloseHandle (hObject=0x228) returned 1 [0030.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml", lpFilePart=0x0) returned 0x4f [0030.814] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0030.814] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0030.814] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0030.815] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0030.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0030.815] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0030.816] GetFileType (hFile=0x228) returned 0x1 [0030.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0030.816] GetFileType (hFile=0x228) returned 0x1 [0031.331] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0031.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0031.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0031.332] GetFileType (hFile=0x23c) returned 0x1 [0031.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0031.332] GetFileType (hFile=0x23c) returned 0x1 [0031.332] ReadFile (in: hFile=0x23c, lpBuffer=0x2415cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2415cd8*, lpNumberOfBytesRead=0x2edf68*=0x648, lpOverlapped=0x0) returned 1 [0031.346] ReadFile (in: hFile=0x23c, lpBuffer=0x2415b08, nNumberOfBytesToRead=0x1b8, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2415b08*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0031.346] ReadFile (in: hFile=0x23c, lpBuffer=0x2415cd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2415cd8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0031.346] CloseHandle (hObject=0x23c) returned 1 [0031.347] WriteFile (in: hFile=0x228, lpBuffer=0x24141d8*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x24141d8*, lpNumberOfBytesWritten=0x2ede38*=0x670, lpOverlapped=0x0) returned 1 [0031.348] CloseHandle (hObject=0x228) returned 1 [0031.348] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0031.349] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0031.352] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0031.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0031.352] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0031.353] GetFileType (hFile=0x228) returned 0x1 [0031.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0031.353] GetFileType (hFile=0x228) returned 0x1 [0031.353] WriteFile (in: hFile=0x228, lpBuffer=0x2420770*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420770*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0031.355] CloseHandle (hObject=0x228) returned 1 [0031.355] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0031.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0031.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0031.355] GetFileType (hFile=0x228) returned 0x1 [0031.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0031.355] GetFileType (hFile=0x228) returned 0x1 [0031.355] WriteFile (in: hFile=0x228, lpBuffer=0x2421830*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2421830*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0031.357] CloseHandle (hObject=0x228) returned 1 [0031.357] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0031.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0031.357] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0031.357] GetFileType (hFile=0x228) returned 0x1 [0031.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0031.357] GetFileType (hFile=0x228) returned 0x1 [0031.357] WriteFile (in: hFile=0x228, lpBuffer=0x24253e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x24253e8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0031.358] CloseHandle (hObject=0x228) returned 1 [0031.359] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0031.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0031.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0031.359] GetFileType (hFile=0x228) returned 0x1 [0031.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0031.359] GetFileType (hFile=0x228) returned 0x1 [0031.359] WriteFile (in: hFile=0x228, lpBuffer=0x2427e08*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2427e08*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0031.360] CloseHandle (hObject=0x228) returned 1 [0031.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0031.363] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0031.364] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0031.364] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0031.375] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.376] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.376] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.376] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.376] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.376] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0031.376] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0031.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0031.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0031.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0031.377] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0031.377] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0031.377] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0031.378] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.379] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.379] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.379] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.379] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0031.379] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0031.379] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0031.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0031.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0031.380] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0031.380] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", dwFileAttributes=0x80) returned 1 [0031.382] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0031.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0031.382] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0031.384] GetFileType (hFile=0x228) returned 0x1 [0031.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0031.384] GetFileType (hFile=0x228) returned 0x1 [0031.886] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0031.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0031.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0031.886] GetFileType (hFile=0x23c) returned 0x1 [0031.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0031.886] GetFileType (hFile=0x23c) returned 0x1 [0031.886] ReadFile (in: hFile=0x23c, lpBuffer=0x2313140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2313140*, lpNumberOfBytesRead=0x2edf68*=0xc72, lpOverlapped=0x0) returned 1 [0031.905] ReadFile (in: hFile=0x23c, lpBuffer=0x2312d9a, nNumberOfBytesToRead=0x38e, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2312d9a*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0031.905] ReadFile (in: hFile=0x23c, lpBuffer=0x2313140, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2313140*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0031.905] CloseHandle (hObject=0x23c) returned 1 [0031.906] WriteFile (in: hFile=0x228, lpBuffer=0x2311630*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2311630*, lpNumberOfBytesWritten=0x2ede38*=0xca0, lpOverlapped=0x0) returned 1 [0031.907] CloseHandle (hObject=0x228) returned 1 [0031.907] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml", lpFilePart=0x0) returned 0x4d [0031.907] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0031.908] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0031.909] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0031.910] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0031.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0031.911] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0031.911] GetFileType (hFile=0x228) returned 0x1 [0031.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0031.911] GetFileType (hFile=0x228) returned 0x1 [0032.472] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0032.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0032.472] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0032.472] GetFileType (hFile=0x23c) returned 0x1 [0032.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0032.472] GetFileType (hFile=0x23c) returned 0x1 [0032.472] ReadFile (in: hFile=0x23c, lpBuffer=0x23fc6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fc6a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0032.490] WriteFile (in: hFile=0x228, lpBuffer=0x23faba8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x23faba8*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0032.491] ReadFile (in: hFile=0x23c, lpBuffer=0x23fc6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fc6a8*, lpNumberOfBytesRead=0x2edf68*=0x6f, lpOverlapped=0x0) returned 1 [0032.491] ReadFile (in: hFile=0x23c, lpBuffer=0x23fc6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fc6a8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0032.491] CloseHandle (hObject=0x23c) returned 1 [0032.491] WriteFile (in: hFile=0x228, lpBuffer=0x23faba8*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23faba8*, lpNumberOfBytesWritten=0x2ede38*=0x90, lpOverlapped=0x0) returned 1 [0032.492] CloseHandle (hObject=0x228) returned 1 [0032.492] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0032.492] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0032.495] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0032.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0032.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0032.496] GetFileType (hFile=0x228) returned 0x1 [0032.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0032.496] GetFileType (hFile=0x228) returned 0x1 [0032.496] WriteFile (in: hFile=0x228, lpBuffer=0x2407ba8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2407ba8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0032.497] CloseHandle (hObject=0x228) returned 1 [0032.497] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0032.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0032.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0032.497] GetFileType (hFile=0x228) returned 0x1 [0032.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0032.497] GetFileType (hFile=0x228) returned 0x1 [0032.497] WriteFile (in: hFile=0x228, lpBuffer=0x2408c68*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2408c68*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0032.498] CloseHandle (hObject=0x228) returned 1 [0032.498] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0032.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0032.499] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0032.499] GetFileType (hFile=0x228) returned 0x1 [0032.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0032.499] GetFileType (hFile=0x228) returned 0x1 [0032.499] WriteFile (in: hFile=0x228, lpBuffer=0x240c820*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x240c820*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0032.500] CloseHandle (hObject=0x228) returned 1 [0032.500] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0032.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0032.500] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0032.501] GetFileType (hFile=0x228) returned 0x1 [0032.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0032.501] GetFileType (hFile=0x228) returned 0x1 [0032.501] WriteFile (in: hFile=0x228, lpBuffer=0x240f240*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x240f240*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0032.502] CloseHandle (hObject=0x228) returned 1 [0032.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0032.502] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0032.502] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0032.502] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0032.503] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.503] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.503] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.503] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.504] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.504] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0032.504] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0032.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0032.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0032.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0032.504] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0032.504] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0032.504] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0032.504] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.504] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.504] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.505] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.505] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0032.505] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0032.505] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0032.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0032.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0032.505] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0032.505] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0032.507] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0032.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0032.507] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0032.508] GetFileType (hFile=0x228) returned 0x1 [0032.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0032.508] GetFileType (hFile=0x228) returned 0x1 [0033.001] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0033.001] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0033.001] GetFileType (hFile=0x23c) returned 0x1 [0033.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0033.001] GetFileType (hFile=0x23c) returned 0x1 [0033.001] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8fa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e8fa0*, lpNumberOfBytesRead=0x2edf68*=0x978, lpOverlapped=0x0) returned 1 [0033.202] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8d00, nNumberOfBytesToRead=0x288, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e8d00*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0033.202] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8fa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e8fa0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0033.202] CloseHandle (hObject=0x23c) returned 1 [0033.202] WriteFile (in: hFile=0x228, lpBuffer=0x22e74a0*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22e74a0*, lpNumberOfBytesWritten=0x2ede38*=0x9a0, lpOverlapped=0x0) returned 1 [0033.203] CloseHandle (hObject=0x228) returned 1 [0033.204] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0033.204] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0033.205] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0033.205] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", dwFileAttributes=0x80) returned 1 [0033.206] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.Horsuke", lpFilePart=0x0) returned 0x52 [0033.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0033.206] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0033.206] GetFileType (hFile=0x228) returned 0x1 [0033.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0033.206] GetFileType (hFile=0x228) returned 0x1 [0033.727] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0033.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0033.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0033.728] GetFileType (hFile=0x23c) returned 0x1 [0033.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0033.728] GetFileType (hFile=0x23c) returned 0x1 [0033.728] ReadFile (in: hFile=0x23c, lpBuffer=0x23d2218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d2218*, lpNumberOfBytesRead=0x2edf68*=0x708, lpOverlapped=0x0) returned 1 [0033.770] ReadFile (in: hFile=0x23c, lpBuffer=0x23d2108, nNumberOfBytesToRead=0xf8, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d2108*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0033.771] ReadFile (in: hFile=0x23c, lpBuffer=0x23d2218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d2218*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0033.771] CloseHandle (hObject=0x23c) returned 1 [0033.771] WriteFile (in: hFile=0x228, lpBuffer=0x23d0718*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23d0718*, lpNumberOfBytesWritten=0x2ede38*=0x730, lpOverlapped=0x0) returned 1 [0033.772] CloseHandle (hObject=0x228) returned 1 [0033.773] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml", lpFilePart=0x0) returned 0x4a [0033.773] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0033.776] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0033.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0033.776] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0033.776] GetFileType (hFile=0x228) returned 0x1 [0033.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0033.776] GetFileType (hFile=0x228) returned 0x1 [0033.776] WriteFile (in: hFile=0x228, lpBuffer=0x23dcd70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23dcd70*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0033.777] CloseHandle (hObject=0x228) returned 1 [0033.777] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0033.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0033.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0033.778] GetFileType (hFile=0x228) returned 0x1 [0033.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0033.778] GetFileType (hFile=0x228) returned 0x1 [0033.778] WriteFile (in: hFile=0x228, lpBuffer=0x23dde30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23dde30*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0033.779] CloseHandle (hObject=0x228) returned 1 [0033.779] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0033.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0033.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0033.780] GetFileType (hFile=0x228) returned 0x1 [0033.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0033.780] GetFileType (hFile=0x228) returned 0x1 [0033.780] WriteFile (in: hFile=0x228, lpBuffer=0x23e19e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23e19e8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0033.780] CloseHandle (hObject=0x228) returned 1 [0033.781] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0033.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0033.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0033.781] GetFileType (hFile=0x228) returned 0x1 [0033.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0033.781] GetFileType (hFile=0x228) returned 0x1 [0033.782] WriteFile (in: hFile=0x228, lpBuffer=0x23e4408*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23e4408*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0033.782] CloseHandle (hObject=0x228) returned 1 [0033.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0033.785] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.785] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.785] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.861] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.862] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0033.862] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0033.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0033.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0033.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0033.862] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0033.862] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0033.863] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0033.863] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.863] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.863] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.864] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.864] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.864] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.864] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0033.864] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0033.864] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0033.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0033.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0033.865] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0033.865] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", dwFileAttributes=0x80) returned 1 [0033.866] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.Horsuke", lpFilePart=0x0) returned 0x53 [0033.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0033.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0033.867] GetFileType (hFile=0x228) returned 0x1 [0033.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0033.867] GetFileType (hFile=0x228) returned 0x1 [0034.396] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0034.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0034.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0034.396] GetFileType (hFile=0x23c) returned 0x1 [0034.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0034.396] GetFileType (hFile=0x23c) returned 0x1 [0034.396] ReadFile (in: hFile=0x23c, lpBuffer=0x22d0dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d0dd8*, lpNumberOfBytesRead=0x2edf68*=0x32b, lpOverlapped=0x0) returned 1 [0034.407] ReadFile (in: hFile=0x23c, lpBuffer=0x22d0dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d0dd8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0034.407] CloseHandle (hObject=0x23c) returned 1 [0034.408] WriteFile (in: hFile=0x228, lpBuffer=0x22cf2d0*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22cf2d0*, lpNumberOfBytesWritten=0x2ede38*=0x350, lpOverlapped=0x0) returned 1 [0034.408] CloseHandle (hObject=0x228) returned 1 [0034.409] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml", lpFilePart=0x0) returned 0x4b [0034.409] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0034.410] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.410] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0034.411] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0034.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0034.411] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0034.411] GetFileType (hFile=0x228) returned 0x1 [0034.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0034.411] GetFileType (hFile=0x228) returned 0x1 [0034.928] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0034.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0034.928] GetFileType (hFile=0x23c) returned 0x1 [0034.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0034.928] GetFileType (hFile=0x23c) returned 0x1 [0034.928] ReadFile (in: hFile=0x23c, lpBuffer=0x23b99b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b99b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0034.941] WriteFile (in: hFile=0x228, lpBuffer=0x23b7eb8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x23b7eb8*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0034.942] ReadFile (in: hFile=0x23c, lpBuffer=0x23b99b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b99b8*, lpNumberOfBytesRead=0x2edf68*=0x6fc, lpOverlapped=0x0) returned 1 [0034.942] ReadFile (in: hFile=0x23c, lpBuffer=0x23b989c, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b989c*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0034.942] ReadFile (in: hFile=0x23c, lpBuffer=0x23b99b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b99b8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0034.942] CloseHandle (hObject=0x23c) returned 1 [0034.942] WriteFile (in: hFile=0x228, lpBuffer=0x23b7eb8*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23b7eb8*, lpNumberOfBytesWritten=0x2ede38*=0x720, lpOverlapped=0x0) returned 1 [0034.943] CloseHandle (hObject=0x228) returned 1 [0034.943] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0034.943] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0034.944] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0034.944] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0034.944] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0034.945] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.945] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.945] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.945] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.945] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0034.945] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0034.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0034.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0034.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0034.945] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en", lpFilePart=0x0) returned 0x47 [0034.946] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\", lpFilePart=0x0) returned 0x48 [0034.946] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0034.946] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.946] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.946] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.946] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0034.946] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0034.946] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0034.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0034.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0034.947] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0034.947] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", dwFileAttributes=0x80) returned 1 [0034.948] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.Horsuke", lpFilePart=0x0) returned 0x59 [0034.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0034.948] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0034.948] GetFileType (hFile=0x228) returned 0x1 [0034.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0034.948] GetFileType (hFile=0x228) returned 0x1 [0035.609] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0035.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0035.609] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0035.609] GetFileType (hFile=0x23c) returned 0x1 [0035.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0035.610] GetFileType (hFile=0x23c) returned 0x1 [0035.610] ReadFile (in: hFile=0x23c, lpBuffer=0x22a71c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a71c8*, lpNumberOfBytesRead=0x2edee8*=0x543, lpOverlapped=0x0) returned 1 [0035.612] ReadFile (in: hFile=0x23c, lpBuffer=0x22a6ef3, nNumberOfBytesToRead=0x2bd, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a6ef3*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0035.612] ReadFile (in: hFile=0x23c, lpBuffer=0x22a71c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a71c8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0035.612] CloseHandle (hObject=0x23c) returned 1 [0035.612] WriteFile (in: hFile=0x228, lpBuffer=0x22a56b8*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22a56b8*, lpNumberOfBytesWritten=0x2eddb8*=0x570, lpOverlapped=0x0) returned 1 [0035.613] CloseHandle (hObject=0x228) returned 1 [0035.614] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml", lpFilePart=0x0) returned 0x51 [0035.615] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0035.617] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0035.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0035.618] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0035.618] GetFileType (hFile=0x228) returned 0x1 [0035.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0035.618] GetFileType (hFile=0x228) returned 0x1 [0035.618] WriteFile (in: hFile=0x228, lpBuffer=0x22b1ba8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22b1ba8*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0035.619] CloseHandle (hObject=0x228) returned 1 [0035.619] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.png", lpFilePart=0x0) returned 0x50 [0035.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0035.619] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0035.619] GetFileType (hFile=0x228) returned 0x1 [0035.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0035.619] GetFileType (hFile=0x228) returned 0x1 [0035.620] WriteFile (in: hFile=0x228, lpBuffer=0x22b2c80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22b2c80*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0035.620] CloseHandle (hObject=0x228) returned 1 [0035.621] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0035.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0035.621] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0035.622] GetFileType (hFile=0x228) returned 0x1 [0035.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0035.623] GetFileType (hFile=0x228) returned 0x1 [0035.623] WriteFile (in: hFile=0x228, lpBuffer=0x22b6880*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x22b6880*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0035.623] CloseHandle (hObject=0x228) returned 1 [0035.624] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0035.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0035.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0035.624] GetFileType (hFile=0x228) returned 0x1 [0035.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0035.624] GetFileType (hFile=0x228) returned 0x1 [0035.624] WriteFile (in: hFile=0x228, lpBuffer=0x22b92d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22b92d0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0035.625] CloseHandle (hObject=0x228) returned 1 [0035.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0035.625] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0035.625] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0035.625] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0035.625] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.625] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.625] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.626] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.626] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0035.626] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0035.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0035.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0035.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0035.626] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es", lpFilePart=0x0) returned 0x47 [0035.626] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\", lpFilePart=0x0) returned 0x48 [0035.626] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0035.626] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.626] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.627] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.627] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0035.627] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0035.627] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0035.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0035.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0035.627] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0035.627] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", dwFileAttributes=0x80) returned 1 [0035.628] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.Horsuke", lpFilePart=0x0) returned 0x59 [0035.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0035.628] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0035.628] GetFileType (hFile=0x228) returned 0x1 [0035.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0035.628] GetFileType (hFile=0x228) returned 0x1 [0036.180] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0036.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0036.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0036.180] GetFileType (hFile=0x23c) returned 0x1 [0036.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0036.180] GetFileType (hFile=0x23c) returned 0x1 [0036.180] ReadFile (in: hFile=0x23c, lpBuffer=0x23a51b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a51b0*, lpNumberOfBytesRead=0x2edee8*=0x5b1, lpOverlapped=0x0) returned 1 [0036.198] ReadFile (in: hFile=0x23c, lpBuffer=0x23a4f49, nNumberOfBytesToRead=0x24f, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a4f49*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0036.199] ReadFile (in: hFile=0x23c, lpBuffer=0x23a51b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a51b0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0036.199] CloseHandle (hObject=0x23c) returned 1 [0036.199] WriteFile (in: hFile=0x228, lpBuffer=0x23a36a0*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x23a36a0*, lpNumberOfBytesWritten=0x2eddb8*=0x5e0, lpOverlapped=0x0) returned 1 [0036.200] CloseHandle (hObject=0x228) returned 1 [0036.201] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml", lpFilePart=0x0) returned 0x51 [0036.201] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0036.203] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0036.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0036.204] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.204] GetFileType (hFile=0x228) returned 0x1 [0036.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0036.204] GetFileType (hFile=0x228) returned 0x1 [0036.204] WriteFile (in: hFile=0x228, lpBuffer=0x23afc00*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23afc00*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0036.205] CloseHandle (hObject=0x228) returned 1 [0036.205] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.png", lpFilePart=0x0) returned 0x50 [0036.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0036.205] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0036.206] GetFileType (hFile=0x228) returned 0x1 [0036.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0036.206] GetFileType (hFile=0x228) returned 0x1 [0036.206] WriteFile (in: hFile=0x228, lpBuffer=0x23b0cd8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23b0cd8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0036.207] CloseHandle (hObject=0x228) returned 1 [0036.207] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0036.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0036.207] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.209] GetFileType (hFile=0x228) returned 0x1 [0036.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0036.209] GetFileType (hFile=0x228) returned 0x1 [0036.209] WriteFile (in: hFile=0x228, lpBuffer=0x23b48d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x23b48d8*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0036.210] CloseHandle (hObject=0x228) returned 1 [0036.210] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0036.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0036.210] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.210] GetFileType (hFile=0x228) returned 0x1 [0036.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0036.210] GetFileType (hFile=0x228) returned 0x1 [0036.210] WriteFile (in: hFile=0x228, lpBuffer=0x23b7328*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23b7328*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0036.211] CloseHandle (hObject=0x228) returned 1 [0036.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0036.211] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0036.211] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0036.211] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0036.212] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.212] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.212] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.212] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.212] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0036.212] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0036.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0036.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0036.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0036.212] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr", lpFilePart=0x0) returned 0x47 [0036.213] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\", lpFilePart=0x0) returned 0x48 [0036.213] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0036.213] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.213] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.213] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.213] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0036.213] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0036.213] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0036.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0036.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0036.214] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0036.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", dwFileAttributes=0x80) returned 1 [0036.215] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.Horsuke", lpFilePart=0x0) returned 0x59 [0036.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0036.215] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0036.215] GetFileType (hFile=0x228) returned 0x1 [0036.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0036.215] GetFileType (hFile=0x228) returned 0x1 [0036.698] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0036.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0036.698] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0036.698] GetFileType (hFile=0x23c) returned 0x1 [0036.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0036.698] GetFileType (hFile=0x23c) returned 0x1 [0036.698] ReadFile (in: hFile=0x23c, lpBuffer=0x22a32b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a32b0*, lpNumberOfBytesRead=0x2edee8*=0x5b2, lpOverlapped=0x0) returned 1 [0036.709] ReadFile (in: hFile=0x23c, lpBuffer=0x22a304a, nNumberOfBytesToRead=0x24e, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a304a*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0036.709] ReadFile (in: hFile=0x23c, lpBuffer=0x22a32b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a32b0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0036.709] CloseHandle (hObject=0x23c) returned 1 [0036.709] WriteFile (in: hFile=0x228, lpBuffer=0x22a17a0*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22a17a0*, lpNumberOfBytesWritten=0x2eddb8*=0x5e0, lpOverlapped=0x0) returned 1 [0036.710] CloseHandle (hObject=0x228) returned 1 [0036.711] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml", lpFilePart=0x0) returned 0x51 [0036.711] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0036.714] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0036.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0036.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.714] GetFileType (hFile=0x228) returned 0x1 [0036.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0036.714] GetFileType (hFile=0x228) returned 0x1 [0036.714] WriteFile (in: hFile=0x228, lpBuffer=0x22add00*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22add00*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0036.715] CloseHandle (hObject=0x228) returned 1 [0036.715] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.png", lpFilePart=0x0) returned 0x50 [0036.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0036.716] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0036.716] GetFileType (hFile=0x228) returned 0x1 [0036.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0036.716] GetFileType (hFile=0x228) returned 0x1 [0036.716] WriteFile (in: hFile=0x228, lpBuffer=0x22aedd8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22aedd8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0036.717] CloseHandle (hObject=0x228) returned 1 [0036.717] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0036.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0036.717] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.718] GetFileType (hFile=0x228) returned 0x1 [0036.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0036.718] GetFileType (hFile=0x228) returned 0x1 [0036.719] WriteFile (in: hFile=0x228, lpBuffer=0x22b29d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x22b29d8*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0036.719] CloseHandle (hObject=0x228) returned 1 [0036.719] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0036.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0036.719] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.720] GetFileType (hFile=0x228) returned 0x1 [0036.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0036.720] GetFileType (hFile=0x228) returned 0x1 [0036.720] WriteFile (in: hFile=0x228, lpBuffer=0x22b5428*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22b5428*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0036.722] CloseHandle (hObject=0x228) returned 1 [0036.724] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0036.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0036.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.724] GetFileType (hFile=0x228) returned 0x1 [0036.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0036.724] GetFileType (hFile=0x228) returned 0x1 [0036.724] WriteFile (in: hFile=0x228, lpBuffer=0x22bf730*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22bf730*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0036.725] CloseHandle (hObject=0x228) returned 1 [0036.725] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0036.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0036.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0036.726] GetFileType (hFile=0x228) returned 0x1 [0036.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0036.726] GetFileType (hFile=0x228) returned 0x1 [0036.726] WriteFile (in: hFile=0x228, lpBuffer=0x22c07f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22c07f0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0036.726] CloseHandle (hObject=0x228) returned 1 [0036.727] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0036.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0036.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.734] GetFileType (hFile=0x228) returned 0x1 [0036.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0036.734] GetFileType (hFile=0x228) returned 0x1 [0036.734] WriteFile (in: hFile=0x228, lpBuffer=0x22c43a8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22c43a8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0036.735] CloseHandle (hObject=0x228) returned 1 [0036.735] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0036.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0036.735] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0036.736] GetFileType (hFile=0x228) returned 0x1 [0036.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0036.736] GetFileType (hFile=0x228) returned 0x1 [0036.736] WriteFile (in: hFile=0x228, lpBuffer=0x22c6dc8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22c6dc8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0036.737] CloseHandle (hObject=0x228) returned 1 [0036.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0036.737] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0036.737] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0036.737] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0036.746] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.746] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.746] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.746] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.746] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.746] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0036.746] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0036.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0036.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0036.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0036.747] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0036.747] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0036.747] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0036.748] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.748] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.748] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.748] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.748] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0036.748] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0036.749] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0036.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0036.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0036.749] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0036.749] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", dwFileAttributes=0x80) returned 1 [0036.751] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.Horsuke", lpFilePart=0x0) returned 0x56 [0036.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0036.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0036.751] GetFileType (hFile=0x228) returned 0x1 [0036.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0036.751] GetFileType (hFile=0x228) returned 0x1 [0037.223] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0037.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0037.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0037.223] GetFileType (hFile=0x23c) returned 0x1 [0037.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0037.223] GetFileType (hFile=0x23c) returned 0x1 [0037.224] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2fa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2fa8*, lpNumberOfBytesRead=0x2edf68*=0x567, lpOverlapped=0x0) returned 1 [0037.232] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2cf7, nNumberOfBytesToRead=0x299, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2cf7*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0037.233] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2fa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2fa8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0037.233] CloseHandle (hObject=0x23c) returned 1 [0037.233] WriteFile (in: hFile=0x228, lpBuffer=0x23b1498*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23b1498*, lpNumberOfBytesWritten=0x2ede38*=0x590, lpOverlapped=0x0) returned 1 [0037.234] CloseHandle (hObject=0x228) returned 1 [0037.235] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml", lpFilePart=0x0) returned 0x4e [0037.235] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0037.236] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0037.236] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0037.237] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0037.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0037.237] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0037.237] GetFileType (hFile=0x228) returned 0x1 [0037.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0037.237] GetFileType (hFile=0x228) returned 0x1 [0037.714] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0037.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0037.714] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0037.715] GetFileType (hFile=0x23c) returned 0x1 [0037.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0037.715] GetFileType (hFile=0x23c) returned 0x1 [0037.715] ReadFile (in: hFile=0x23c, lpBuffer=0x229be88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x229be88*, lpNumberOfBytesRead=0x2edf68*=0x93a, lpOverlapped=0x0) returned 1 [0037.726] ReadFile (in: hFile=0x23c, lpBuffer=0x229bbaa, nNumberOfBytesToRead=0x2c6, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x229bbaa*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0037.726] ReadFile (in: hFile=0x23c, lpBuffer=0x229be88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x229be88*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0037.726] CloseHandle (hObject=0x23c) returned 1 [0037.726] WriteFile (in: hFile=0x228, lpBuffer=0x229a388*, nNumberOfBytesToWrite=0x960, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x229a388*, lpNumberOfBytesWritten=0x2ede38*=0x960, lpOverlapped=0x0) returned 1 [0037.727] CloseHandle (hObject=0x228) returned 1 [0037.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0037.728] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0037.729] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0037.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0037.729] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0037.730] GetFileType (hFile=0x228) returned 0x1 [0037.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0037.730] GetFileType (hFile=0x228) returned 0x1 [0037.730] WriteFile (in: hFile=0x228, lpBuffer=0x22a6c28*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22a6c28*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0037.730] CloseHandle (hObject=0x228) returned 1 [0037.731] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0037.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0037.731] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0037.731] GetFileType (hFile=0x228) returned 0x1 [0037.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0037.731] GetFileType (hFile=0x228) returned 0x1 [0037.731] WriteFile (in: hFile=0x228, lpBuffer=0x22a7ce8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22a7ce8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0037.732] CloseHandle (hObject=0x228) returned 1 [0037.732] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0037.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0037.732] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0037.732] GetFileType (hFile=0x228) returned 0x1 [0037.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0037.732] GetFileType (hFile=0x228) returned 0x1 [0037.732] WriteFile (in: hFile=0x228, lpBuffer=0x22ab8a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22ab8a0*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0037.733] CloseHandle (hObject=0x228) returned 1 [0037.733] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0037.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0037.733] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0037.734] GetFileType (hFile=0x228) returned 0x1 [0037.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0037.734] GetFileType (hFile=0x228) returned 0x1 [0037.734] WriteFile (in: hFile=0x228, lpBuffer=0x22ae2c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22ae2c0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0037.735] CloseHandle (hObject=0x228) returned 1 [0037.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0037.735] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0037.736] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0037.736] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0037.844] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.845] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0037.845] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0037.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0037.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0037.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0037.846] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0037.846] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0037.846] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0037.847] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0037.847] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0037.847] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0037.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0037.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0037.848] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0037.848] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", dwFileAttributes=0x80) returned 1 [0037.849] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.Horsuke", lpFilePart=0x0) returned 0x56 [0037.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0037.850] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0037.850] GetFileType (hFile=0x228) returned 0x1 [0037.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0037.850] GetFileType (hFile=0x228) returned 0x1 [0038.367] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0038.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0038.367] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0038.367] GetFileType (hFile=0x23c) returned 0x1 [0038.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0038.367] GetFileType (hFile=0x23c) returned 0x1 [0038.367] ReadFile (in: hFile=0x23c, lpBuffer=0x239a4b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x239a4b0*, lpNumberOfBytesRead=0x2edf68*=0x4cf, lpOverlapped=0x0) returned 1 [0038.377] ReadFile (in: hFile=0x23c, lpBuffer=0x239a167, nNumberOfBytesToRead=0x331, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x239a167*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0038.378] ReadFile (in: hFile=0x23c, lpBuffer=0x239a4b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x239a4b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0038.378] CloseHandle (hObject=0x23c) returned 1 [0038.378] WriteFile (in: hFile=0x228, lpBuffer=0x23989a0*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23989a0*, lpNumberOfBytesWritten=0x2ede38*=0x4f0, lpOverlapped=0x0) returned 1 [0038.379] CloseHandle (hObject=0x228) returned 1 [0038.379] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml", lpFilePart=0x0) returned 0x4e [0038.379] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0038.380] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0038.380] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0038.381] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0038.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0038.381] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0038.382] GetFileType (hFile=0x228) returned 0x1 [0038.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0038.382] GetFileType (hFile=0x228) returned 0x1 [0038.942] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0038.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0038.942] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0038.943] GetFileType (hFile=0x23c) returned 0x1 [0038.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0038.943] GetFileType (hFile=0x23c) returned 0x1 [0038.943] ReadFile (in: hFile=0x23c, lpBuffer=0x2283310, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2283310*, lpNumberOfBytesRead=0x2edf68*=0x73c, lpOverlapped=0x0) returned 1 [0038.956] ReadFile (in: hFile=0x23c, lpBuffer=0x2283234, nNumberOfBytesToRead=0xc4, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2283234*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0038.957] ReadFile (in: hFile=0x23c, lpBuffer=0x2283310, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2283310*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0038.957] CloseHandle (hObject=0x23c) returned 1 [0038.957] WriteFile (in: hFile=0x228, lpBuffer=0x2281810*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2281810*, lpNumberOfBytesWritten=0x2ede38*=0x760, lpOverlapped=0x0) returned 1 [0038.958] CloseHandle (hObject=0x228) returned 1 [0038.958] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0038.958] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0038.961] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0038.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0038.961] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0038.962] GetFileType (hFile=0x228) returned 0x1 [0038.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0038.962] GetFileType (hFile=0x228) returned 0x1 [0038.962] WriteFile (in: hFile=0x228, lpBuffer=0x228de98*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x228de98*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0038.963] CloseHandle (hObject=0x228) returned 1 [0038.963] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0038.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0038.963] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0038.963] GetFileType (hFile=0x228) returned 0x1 [0038.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0038.963] GetFileType (hFile=0x228) returned 0x1 [0038.963] WriteFile (in: hFile=0x228, lpBuffer=0x228ef58*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x228ef58*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0038.964] CloseHandle (hObject=0x228) returned 1 [0038.965] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0038.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0038.965] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0038.965] GetFileType (hFile=0x228) returned 0x1 [0038.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0038.966] GetFileType (hFile=0x228) returned 0x1 [0038.966] WriteFile (in: hFile=0x228, lpBuffer=0x2292b10*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2292b10*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0038.966] CloseHandle (hObject=0x228) returned 1 [0038.967] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0038.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0038.967] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0038.967] GetFileType (hFile=0x228) returned 0x1 [0038.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0038.967] GetFileType (hFile=0x228) returned 0x1 [0038.967] WriteFile (in: hFile=0x228, lpBuffer=0x2295530*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2295530*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0038.968] CloseHandle (hObject=0x228) returned 1 [0038.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0038.968] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0038.968] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0038.968] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0038.969] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.969] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.969] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.969] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.969] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.969] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0038.969] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0038.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0038.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0038.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0038.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0038.970] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0038.970] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0038.970] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.970] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.970] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.970] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.970] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0038.970] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0038.971] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0038.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0038.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0038.971] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0038.971] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0038.973] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0038.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0038.973] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0038.974] GetFileType (hFile=0x228) returned 0x1 [0038.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0038.974] GetFileType (hFile=0x228) returned 0x1 [0039.513] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0039.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0039.514] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0039.514] GetFileType (hFile=0x23c) returned 0x1 [0039.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0039.514] GetFileType (hFile=0x23c) returned 0x1 [0039.514] ReadFile (in: hFile=0x23c, lpBuffer=0x2381550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2381550*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0039.530] WriteFile (in: hFile=0x228, lpBuffer=0x237fa50*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x237fa50*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0039.531] ReadFile (in: hFile=0x23c, lpBuffer=0x2381550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2381550*, lpNumberOfBytesRead=0x2edf68*=0x861, lpOverlapped=0x0) returned 1 [0039.531] ReadFile (in: hFile=0x23c, lpBuffer=0x2381199, nNumberOfBytesToRead=0x39f, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2381199*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0039.531] ReadFile (in: hFile=0x23c, lpBuffer=0x2381550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2381550*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0039.531] CloseHandle (hObject=0x23c) returned 1 [0039.531] WriteFile (in: hFile=0x228, lpBuffer=0x237fa50*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x237fa50*, lpNumberOfBytesWritten=0x2ede38*=0x890, lpOverlapped=0x0) returned 1 [0039.531] CloseHandle (hObject=0x228) returned 1 [0039.532] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0039.532] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0039.533] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0039.533] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", dwFileAttributes=0x80) returned 1 [0039.534] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.Horsuke", lpFilePart=0x0) returned 0x53 [0039.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0039.534] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0039.534] GetFileType (hFile=0x228) returned 0x1 [0039.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0039.535] GetFileType (hFile=0x228) returned 0x1 [0039.994] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0039.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0039.994] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0039.994] GetFileType (hFile=0x23c) returned 0x1 [0039.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0039.994] GetFileType (hFile=0x23c) returned 0x1 [0039.994] ReadFile (in: hFile=0x23c, lpBuffer=0x226b7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x226b7f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0040.001] WriteFile (in: hFile=0x228, lpBuffer=0x2269cf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2269cf0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0040.002] ReadFile (in: hFile=0x23c, lpBuffer=0x226b7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x226b7f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0040.002] WriteFile (in: hFile=0x228, lpBuffer=0x2269cf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2269cf0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0040.002] ReadFile (in: hFile=0x23c, lpBuffer=0x226b7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x226b7f8*, lpNumberOfBytesRead=0x2edf68*=0x51f, lpOverlapped=0x0) returned 1 [0040.002] ReadFile (in: hFile=0x23c, lpBuffer=0x226b4ff, nNumberOfBytesToRead=0x2e1, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x226b4ff*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0040.002] ReadFile (in: hFile=0x23c, lpBuffer=0x226b7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x226b7f8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0040.002] CloseHandle (hObject=0x23c) returned 1 [0040.002] WriteFile (in: hFile=0x228, lpBuffer=0x2269cf0*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2269cf0*, lpNumberOfBytesWritten=0x2ede38*=0x540, lpOverlapped=0x0) returned 1 [0040.003] CloseHandle (hObject=0x228) returned 1 [0040.003] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml", lpFilePart=0x0) returned 0x4b [0040.004] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0040.007] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0040.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0040.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0040.008] GetFileType (hFile=0x228) returned 0x1 [0040.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0040.008] GetFileType (hFile=0x228) returned 0x1 [0040.008] WriteFile (in: hFile=0x228, lpBuffer=0x2278220*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2278220*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0040.009] CloseHandle (hObject=0x228) returned 1 [0040.009] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0040.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0040.009] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0040.019] GetFileType (hFile=0x228) returned 0x1 [0040.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0040.019] GetFileType (hFile=0x228) returned 0x1 [0040.019] WriteFile (in: hFile=0x228, lpBuffer=0x22792e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22792e0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0040.020] CloseHandle (hObject=0x228) returned 1 [0040.021] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0040.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0040.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0040.021] GetFileType (hFile=0x228) returned 0x1 [0040.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0040.021] GetFileType (hFile=0x228) returned 0x1 [0040.021] WriteFile (in: hFile=0x228, lpBuffer=0x227ce98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x227ce98*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0040.022] CloseHandle (hObject=0x228) returned 1 [0040.023] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0040.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0040.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0040.023] GetFileType (hFile=0x228) returned 0x1 [0040.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0040.023] GetFileType (hFile=0x228) returned 0x1 [0040.023] WriteFile (in: hFile=0x228, lpBuffer=0x227f8b8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x227f8b8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0040.024] CloseHandle (hObject=0x228) returned 1 [0040.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0040.025] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0040.025] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0040.025] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0040.040] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.041] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.041] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.041] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.041] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.041] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0040.041] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0040.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0040.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0040.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0040.042] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0040.042] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0040.042] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0040.043] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.044] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.044] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.044] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.044] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0040.044] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0040.045] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0040.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0040.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0040.046] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0040.046] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", dwFileAttributes=0x80) returned 1 [0040.047] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0040.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0040.047] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0040.048] GetFileType (hFile=0x228) returned 0x1 [0040.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0040.048] GetFileType (hFile=0x228) returned 0x1 [0040.508] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0040.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0040.508] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0040.508] GetFileType (hFile=0x23c) returned 0x1 [0040.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0040.509] GetFileType (hFile=0x23c) returned 0x1 [0040.509] ReadFile (in: hFile=0x23c, lpBuffer=0x236ba78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x236ba78*, lpNumberOfBytesRead=0x2edf68*=0x646, lpOverlapped=0x0) returned 1 [0040.522] ReadFile (in: hFile=0x23c, lpBuffer=0x236b8a6, nNumberOfBytesToRead=0x1ba, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x236b8a6*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0040.523] ReadFile (in: hFile=0x23c, lpBuffer=0x236ba78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x236ba78*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0040.523] CloseHandle (hObject=0x23c) returned 1 [0040.523] WriteFile (in: hFile=0x228, lpBuffer=0x2369f68*, nNumberOfBytesToWrite=0x670, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2369f68*, lpNumberOfBytesWritten=0x2ede38*=0x670, lpOverlapped=0x0) returned 1 [0040.524] CloseHandle (hObject=0x228) returned 1 [0040.525] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml", lpFilePart=0x0) returned 0x4d [0040.525] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0040.526] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0040.526] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0040.527] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0040.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0040.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0040.528] GetFileType (hFile=0x228) returned 0x1 [0040.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0040.528] GetFileType (hFile=0x228) returned 0x1 [0041.003] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0041.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0041.003] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0041.003] GetFileType (hFile=0x23c) returned 0x1 [0041.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0041.003] GetFileType (hFile=0x23c) returned 0x1 [0041.003] ReadFile (in: hFile=0x23c, lpBuffer=0x22545e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22545e0*, lpNumberOfBytesRead=0x2edf68*=0x7c4, lpOverlapped=0x0) returned 1 [0041.014] ReadFile (in: hFile=0x23c, lpBuffer=0x225458c, nNumberOfBytesToRead=0x3c, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x225458c*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0041.015] ReadFile (in: hFile=0x23c, lpBuffer=0x22545e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22545e0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0041.015] CloseHandle (hObject=0x23c) returned 1 [0041.015] WriteFile (in: hFile=0x228, lpBuffer=0x2252ae0*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2252ae0*, lpNumberOfBytesWritten=0x2ede38*=0x7f0, lpOverlapped=0x0) returned 1 [0041.016] CloseHandle (hObject=0x228) returned 1 [0041.017] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0041.017] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0041.020] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0041.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0041.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0041.020] GetFileType (hFile=0x228) returned 0x1 [0041.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0041.020] GetFileType (hFile=0x228) returned 0x1 [0041.021] WriteFile (in: hFile=0x228, lpBuffer=0x225f200*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x225f200*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0041.021] CloseHandle (hObject=0x228) returned 1 [0041.022] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0041.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0041.022] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0041.022] GetFileType (hFile=0x228) returned 0x1 [0041.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0041.022] GetFileType (hFile=0x228) returned 0x1 [0041.022] WriteFile (in: hFile=0x228, lpBuffer=0x22602c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22602c0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0041.023] CloseHandle (hObject=0x228) returned 1 [0041.023] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0041.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0041.023] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0041.023] GetFileType (hFile=0x228) returned 0x1 [0041.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0041.023] GetFileType (hFile=0x228) returned 0x1 [0041.023] WriteFile (in: hFile=0x228, lpBuffer=0x2263e78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2263e78*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0041.024] CloseHandle (hObject=0x228) returned 1 [0041.024] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0041.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0041.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0041.025] GetFileType (hFile=0x228) returned 0x1 [0041.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0041.025] GetFileType (hFile=0x228) returned 0x1 [0041.025] WriteFile (in: hFile=0x228, lpBuffer=0x2266898*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2266898*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0041.026] CloseHandle (hObject=0x228) returned 1 [0041.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0041.027] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0041.027] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0041.027] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0041.048] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.048] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.048] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.048] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.048] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.049] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0041.049] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0041.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0041.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0041.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0041.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0041.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0041.050] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0041.050] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.050] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.051] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.051] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.051] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0041.051] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0041.051] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0041.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0041.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0041.052] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0041.052] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", dwFileAttributes=0x80) returned 1 [0041.054] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0041.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0041.054] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0041.054] GetFileType (hFile=0x228) returned 0x1 [0041.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0041.054] GetFileType (hFile=0x228) returned 0x1 [0041.540] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0041.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0041.540] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0041.540] GetFileType (hFile=0x23c) returned 0x1 [0041.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0041.540] GetFileType (hFile=0x23c) returned 0x1 [0041.540] ReadFile (in: hFile=0x23c, lpBuffer=0x2352168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2352168*, lpNumberOfBytesRead=0x2edf68*=0x5ac, lpOverlapped=0x0) returned 1 [0041.543] ReadFile (in: hFile=0x23c, lpBuffer=0x2351efc, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2351efc*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0041.543] ReadFile (in: hFile=0x23c, lpBuffer=0x2352168, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2352168*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0041.543] CloseHandle (hObject=0x23c) returned 1 [0041.543] WriteFile (in: hFile=0x228, lpBuffer=0x2350658*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2350658*, lpNumberOfBytesWritten=0x2ede38*=0x5d0, lpOverlapped=0x0) returned 1 [0041.544] CloseHandle (hObject=0x228) returned 1 [0041.545] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml", lpFilePart=0x0) returned 0x4d [0041.545] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0041.546] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0041.546] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0041.548] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0041.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0041.548] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0041.548] GetFileType (hFile=0x228) returned 0x1 [0041.548] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0041.549] GetFileType (hFile=0x228) returned 0x1 [0042.086] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0042.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0042.086] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0042.086] GetFileType (hFile=0x23c) returned 0x1 [0042.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0042.087] GetFileType (hFile=0x23c) returned 0x1 [0042.087] ReadFile (in: hFile=0x23c, lpBuffer=0x2439110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2439110*, lpNumberOfBytesRead=0x2edf68*=0x750, lpOverlapped=0x0) returned 1 [0042.099] ReadFile (in: hFile=0x23c, lpBuffer=0x2439048, nNumberOfBytesToRead=0xb0, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2439048*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0042.100] ReadFile (in: hFile=0x23c, lpBuffer=0x2439110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2439110*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0042.100] CloseHandle (hObject=0x23c) returned 1 [0042.100] WriteFile (in: hFile=0x228, lpBuffer=0x2437610*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2437610*, lpNumberOfBytesWritten=0x2ede38*=0x780, lpOverlapped=0x0) returned 1 [0042.101] CloseHandle (hObject=0x228) returned 1 [0042.101] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0042.101] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0042.107] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0042.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0042.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0042.107] GetFileType (hFile=0x228) returned 0x1 [0042.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0042.107] GetFileType (hFile=0x228) returned 0x1 [0042.108] WriteFile (in: hFile=0x228, lpBuffer=0x2242e70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2242e70*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0042.109] CloseHandle (hObject=0x228) returned 1 [0042.109] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0042.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0042.109] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0042.109] GetFileType (hFile=0x228) returned 0x1 [0042.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0042.109] GetFileType (hFile=0x228) returned 0x1 [0042.109] WriteFile (in: hFile=0x228, lpBuffer=0x2243f30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2243f30*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0042.110] CloseHandle (hObject=0x228) returned 1 [0042.110] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0042.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0042.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0042.111] GetFileType (hFile=0x228) returned 0x1 [0042.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0042.111] GetFileType (hFile=0x228) returned 0x1 [0042.111] WriteFile (in: hFile=0x228, lpBuffer=0x2247ae8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2247ae8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0042.112] CloseHandle (hObject=0x228) returned 1 [0042.112] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0042.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0042.112] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0042.112] GetFileType (hFile=0x228) returned 0x1 [0042.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0042.113] GetFileType (hFile=0x228) returned 0x1 [0042.113] WriteFile (in: hFile=0x228, lpBuffer=0x224a508*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x224a508*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0042.113] CloseHandle (hObject=0x228) returned 1 [0042.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0042.114] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0042.114] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0042.114] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0042.119] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.119] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.119] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.119] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.119] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.119] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0042.120] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0042.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0042.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0042.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0042.120] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0042.121] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0042.121] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0042.122] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.122] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.122] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.122] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.122] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0042.122] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0042.123] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0042.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0042.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0042.123] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0042.124] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", dwFileAttributes=0x80) returned 1 [0042.126] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.Horsuke", lpFilePart=0x0) returned 0x54 [0042.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0042.126] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0042.126] GetFileType (hFile=0x228) returned 0x1 [0042.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0042.126] GetFileType (hFile=0x228) returned 0x1 [0042.647] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0042.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0042.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0042.647] GetFileType (hFile=0x23c) returned 0x1 [0042.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0042.647] GetFileType (hFile=0x23c) returned 0x1 [0042.647] ReadFile (in: hFile=0x23c, lpBuffer=0x2334c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2334c08*, lpNumberOfBytesRead=0x2edf68*=0x391, lpOverlapped=0x0) returned 1 [0042.657] ReadFile (in: hFile=0x23c, lpBuffer=0x2334c08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2334c08*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0042.657] CloseHandle (hObject=0x23c) returned 1 [0042.657] WriteFile (in: hFile=0x228, lpBuffer=0x23330f8*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23330f8*, lpNumberOfBytesWritten=0x2ede38*=0x3c0, lpOverlapped=0x0) returned 1 [0042.658] CloseHandle (hObject=0x228) returned 1 [0042.658] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml", lpFilePart=0x0) returned 0x4c [0042.659] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0042.659] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0042.659] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0042.660] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0042.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0042.661] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0042.661] GetFileType (hFile=0x228) returned 0x1 [0042.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0042.661] GetFileType (hFile=0x228) returned 0x1 [0043.170] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0043.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0043.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0043.170] GetFileType (hFile=0x23c) returned 0x1 [0043.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0043.170] GetFileType (hFile=0x23c) returned 0x1 [0043.170] ReadFile (in: hFile=0x23c, lpBuffer=0x23fc3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fc3b0*, lpNumberOfBytesRead=0x2edf68*=0x5ac, lpOverlapped=0x0) returned 1 [0043.186] ReadFile (in: hFile=0x23c, lpBuffer=0x23fc144, nNumberOfBytesToRead=0x254, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fc144*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0043.186] ReadFile (in: hFile=0x23c, lpBuffer=0x23fc3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fc3b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0043.186] CloseHandle (hObject=0x23c) returned 1 [0043.186] WriteFile (in: hFile=0x228, lpBuffer=0x23fa8b0*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23fa8b0*, lpNumberOfBytesWritten=0x2ede38*=0x5d0, lpOverlapped=0x0) returned 1 [0043.187] CloseHandle (hObject=0x228) returned 1 [0043.188] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0043.188] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0043.190] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0043.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0043.191] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0043.191] GetFileType (hFile=0x228) returned 0x1 [0043.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0043.191] GetFileType (hFile=0x228) returned 0x1 [0043.191] WriteFile (in: hFile=0x228, lpBuffer=0x2406da8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2406da8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0043.192] CloseHandle (hObject=0x228) returned 1 [0043.192] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0043.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0043.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0043.193] GetFileType (hFile=0x228) returned 0x1 [0043.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0043.193] GetFileType (hFile=0x228) returned 0x1 [0043.193] WriteFile (in: hFile=0x228, lpBuffer=0x2407e68*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2407e68*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0043.194] CloseHandle (hObject=0x228) returned 1 [0043.194] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0043.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0043.194] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0043.194] GetFileType (hFile=0x228) returned 0x1 [0043.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0043.195] GetFileType (hFile=0x228) returned 0x1 [0043.195] WriteFile (in: hFile=0x228, lpBuffer=0x240ba20*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x240ba20*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0043.195] CloseHandle (hObject=0x228) returned 1 [0043.196] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0043.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0043.196] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0043.196] GetFileType (hFile=0x228) returned 0x1 [0043.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0043.196] GetFileType (hFile=0x228) returned 0x1 [0043.196] WriteFile (in: hFile=0x228, lpBuffer=0x240e440*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x240e440*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0043.197] CloseHandle (hObject=0x228) returned 1 [0043.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0043.197] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0043.197] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0043.197] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0043.214] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.214] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.214] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.214] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.214] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.214] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.215] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.216] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0043.216] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0043.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0043.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0043.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0043.217] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0043.217] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0043.217] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0043.217] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.218] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.219] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0043.220] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0043.220] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0043.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0043.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0043.220] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0043.220] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", dwFileAttributes=0x80) returned 1 [0043.222] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Horsuke", lpFilePart=0x0) returned 0x53 [0043.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0043.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0043.223] GetFileType (hFile=0x228) returned 0x1 [0043.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0043.223] GetFileType (hFile=0x228) returned 0x1 [0043.701] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0043.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0043.701] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0043.702] GetFileType (hFile=0x23c) returned 0x1 [0043.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0043.702] GetFileType (hFile=0x23c) returned 0x1 [0043.702] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.804] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.868] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.868] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.868] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.869] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.869] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.869] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.870] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.870] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.870] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.871] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.871] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.871] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.872] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.872] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.872] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.874] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.874] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.874] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.875] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.875] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.875] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.876] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.876] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.876] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.877] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.877] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0043.877] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.262] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.262] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.263] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.263] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.263] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.263] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.263] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.300] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.301] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.301] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.301] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.301] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.302] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.302] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.302] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.302] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.303] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.303] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.303] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.303] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.303] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.304] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.304] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.304] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.304] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.304] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.305] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.306] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.307] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.307] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.307] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.307] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.308] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.309] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.310] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.311] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.312] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.313] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.314] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.315] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.316] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.317] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.320] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.320] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.320] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.320] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.320] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.321] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.322] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.323] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.324] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.324] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.324] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.324] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.328] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.328] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.328] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.328] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.328] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.328] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.330] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.331] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.332] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.335] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.335] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.335] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.335] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.342] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.342] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.342] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.342] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.343] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.343] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.343] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.343] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.344] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.345] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.348] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.348] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.348] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.348] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.349] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.349] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.349] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.349] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.350] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.351] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.351] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.351] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.351] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x975, lpOverlapped=0x0) returned 1 [0044.351] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe215, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe215*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0044.351] ReadFile (in: hFile=0x23c, lpBuffer=0x22fe4b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fe4b8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0044.352] WriteFile (in: hFile=0x228, lpBuffer=0x22fc9b0*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22fc9b0*, lpNumberOfBytesWritten=0x2ede38*=0x9a0, lpOverlapped=0x0) returned 1 [0044.352] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml", lpFilePart=0x0) returned 0x4b [0044.352] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0044.385] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0044.385] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", dwFileAttributes=0x80) returned 1 [0044.387] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.Horsuke", lpFilePart=0x0) returned 0x54 [0044.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0044.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0044.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0044.876] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0044.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0044.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0044.876] GetFileType (hFile=0x23c) returned 0x1 [0044.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0044.876] GetFileType (hFile=0x23c) returned 0x1 [0044.876] ReadFile (in: hFile=0x23c, lpBuffer=0x227bf68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227bf68*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0044.889] WriteFile (in: hFile=0x228, lpBuffer=0x227a458*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x227a458*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0044.890] ReadFile (in: hFile=0x23c, lpBuffer=0x227bf68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227bf68*, lpNumberOfBytesRead=0x2edf68*=0x5b5, lpOverlapped=0x0) returned 1 [0044.890] ReadFile (in: hFile=0x23c, lpBuffer=0x227bd05, nNumberOfBytesToRead=0x24b, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227bd05*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0044.890] ReadFile (in: hFile=0x23c, lpBuffer=0x227bf68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227bf68*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0044.890] CloseHandle (hObject=0x23c) returned 1 [0044.891] WriteFile (in: hFile=0x228, lpBuffer=0x227a458*, nNumberOfBytesToWrite=0x5e0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x227a458*, lpNumberOfBytesWritten=0x2ede38*=0x5e0, lpOverlapped=0x0) returned 1 [0044.891] CloseHandle (hObject=0x228) returned 1 [0044.892] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml", lpFilePart=0x0) returned 0x4c [0044.892] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0044.893] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0044.893] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", dwFileAttributes=0x80) returned 1 [0044.894] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.Horsuke", lpFilePart=0x0) returned 0x57 [0044.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0044.894] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0044.894] GetFileType (hFile=0x228) returned 0x1 [0044.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0044.895] GetFileType (hFile=0x228) returned 0x1 [0045.355] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0045.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0045.355] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0045.355] GetFileType (hFile=0x23c) returned 0x1 [0045.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0045.355] GetFileType (hFile=0x23c) returned 0x1 [0045.355] ReadFile (in: hFile=0x23c, lpBuffer=0x2365ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2365ec0*, lpNumberOfBytesRead=0x2edf68*=0x333, lpOverlapped=0x0) returned 1 [0045.379] ReadFile (in: hFile=0x23c, lpBuffer=0x2365ec0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2365ec0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0045.379] CloseHandle (hObject=0x23c) returned 1 [0045.379] WriteFile (in: hFile=0x228, lpBuffer=0x23643a8*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23643a8*, lpNumberOfBytesWritten=0x2ede38*=0x360, lpOverlapped=0x0) returned 1 [0045.380] CloseHandle (hObject=0x228) returned 1 [0045.381] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml", lpFilePart=0x0) returned 0x4f [0045.381] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0045.382] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0045.382] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0045.383] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0045.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0045.383] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0045.383] GetFileType (hFile=0x228) returned 0x1 [0045.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0045.383] GetFileType (hFile=0x228) returned 0x1 [0045.862] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0045.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0045.862] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0045.863] GetFileType (hFile=0x23c) returned 0x1 [0045.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0045.863] GetFileType (hFile=0x23c) returned 0x1 [0045.863] ReadFile (in: hFile=0x23c, lpBuffer=0x224ec08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224ec08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0045.879] WriteFile (in: hFile=0x228, lpBuffer=0x224d108*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x224d108*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0045.880] ReadFile (in: hFile=0x23c, lpBuffer=0x224ec08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224ec08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0045.880] WriteFile (in: hFile=0x228, lpBuffer=0x224d108*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x224d108*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0045.881] ReadFile (in: hFile=0x23c, lpBuffer=0x224ec08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224ec08*, lpNumberOfBytesRead=0x2edf68*=0x488, lpOverlapped=0x0) returned 1 [0045.881] ReadFile (in: hFile=0x23c, lpBuffer=0x224e878, nNumberOfBytesToRead=0x378, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224e878*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0045.881] ReadFile (in: hFile=0x23c, lpBuffer=0x224ec08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224ec08*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0045.881] CloseHandle (hObject=0x23c) returned 1 [0045.881] WriteFile (in: hFile=0x228, lpBuffer=0x224d108*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x224d108*, lpNumberOfBytesWritten=0x2ede38*=0x4b0, lpOverlapped=0x0) returned 1 [0045.881] CloseHandle (hObject=0x228) returned 1 [0045.882] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0045.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0045.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0045.883] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0045.883] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0045.883] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0045.884] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0045.884] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0045.884] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0045.884] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0045.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0045.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0045.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0045.884] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033", lpFilePart=0x0) returned 0x43 [0045.884] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\", lpFilePart=0x0) returned 0x44 [0045.884] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0045.885] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0045.885] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0045.885] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0045.885] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0045.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0045.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0045.887] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0045.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0045.887] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0045.887] GetFileType (hFile=0x228) returned 0x1 [0045.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0045.887] GetFileType (hFile=0x228) returned 0x1 [0045.888] WriteFile (in: hFile=0x228, lpBuffer=0x225dad8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x225dad8*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0045.888] CloseHandle (hObject=0x228) returned 1 [0045.888] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.png", lpFilePart=0x0) returned 0x4c [0045.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0045.889] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0045.889] GetFileType (hFile=0x228) returned 0x1 [0045.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0045.889] GetFileType (hFile=0x228) returned 0x1 [0045.889] WriteFile (in: hFile=0x228, lpBuffer=0x225eba8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x225eba8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0045.890] CloseHandle (hObject=0x228) returned 1 [0045.890] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0045.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0045.890] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0045.891] GetFileType (hFile=0x228) returned 0x1 [0045.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0045.891] GetFileType (hFile=0x228) returned 0x1 [0045.891] WriteFile (in: hFile=0x228, lpBuffer=0x2262790*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2262790*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0045.892] CloseHandle (hObject=0x228) returned 1 [0045.892] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0045.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0045.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0045.899] GetFileType (hFile=0x228) returned 0x1 [0045.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0045.899] GetFileType (hFile=0x228) returned 0x1 [0045.899] WriteFile (in: hFile=0x228, lpBuffer=0x22651d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22651d0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0045.900] CloseHandle (hObject=0x228) returned 1 [0045.901] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0045.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0045.901] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0045.902] GetFileType (hFile=0x228) returned 0x1 [0045.902] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0045.902] GetFileType (hFile=0x228) returned 0x1 [0045.902] WriteFile (in: hFile=0x228, lpBuffer=0x226f4d8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x226f4d8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0045.902] CloseHandle (hObject=0x228) returned 1 [0045.903] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0045.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0045.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0045.903] GetFileType (hFile=0x228) returned 0x1 [0045.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0045.903] GetFileType (hFile=0x228) returned 0x1 [0045.904] WriteFile (in: hFile=0x228, lpBuffer=0x2270598*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2270598*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0045.904] CloseHandle (hObject=0x228) returned 1 [0045.905] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0045.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0045.905] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0045.905] GetFileType (hFile=0x228) returned 0x1 [0045.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0045.905] GetFileType (hFile=0x228) returned 0x1 [0045.905] WriteFile (in: hFile=0x228, lpBuffer=0x2274150*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2274150*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0045.906] CloseHandle (hObject=0x228) returned 1 [0045.906] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0045.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0045.906] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0045.906] GetFileType (hFile=0x228) returned 0x1 [0045.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0045.906] GetFileType (hFile=0x228) returned 0x1 [0045.906] WriteFile (in: hFile=0x228, lpBuffer=0x2276b70*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2276b70*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0045.907] CloseHandle (hObject=0x228) returned 1 [0045.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0045.907] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0045.907] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0045.907] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0045.918] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.919] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.919] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.919] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.919] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.919] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0045.919] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0045.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0045.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0045.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0045.920] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0045.920] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0045.920] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0045.921] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.921] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.921] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.921] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.921] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0045.921] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0045.921] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0045.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0045.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0045.922] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0045.922] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", dwFileAttributes=0x80) returned 1 [0045.924] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.Horsuke", lpFilePart=0x0) returned 0x57 [0045.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0045.924] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0045.924] GetFileType (hFile=0x228) returned 0x1 [0045.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0045.924] GetFileType (hFile=0x228) returned 0x1 [0046.461] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0046.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0046.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0046.461] GetFileType (hFile=0x23c) returned 0x1 [0046.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0046.461] GetFileType (hFile=0x23c) returned 0x1 [0046.461] ReadFile (in: hFile=0x23c, lpBuffer=0x2362e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362e28*, lpNumberOfBytesRead=0x2edf68*=0x333, lpOverlapped=0x0) returned 1 [0046.472] ReadFile (in: hFile=0x23c, lpBuffer=0x2362e28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362e28*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0046.472] CloseHandle (hObject=0x23c) returned 1 [0046.473] WriteFile (in: hFile=0x228, lpBuffer=0x2361310*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2361310*, lpNumberOfBytesWritten=0x2ede38*=0x360, lpOverlapped=0x0) returned 1 [0046.473] CloseHandle (hObject=0x228) returned 1 [0046.474] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml", lpFilePart=0x0) returned 0x4f [0046.474] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0046.475] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0046.475] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0046.476] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0046.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0046.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0046.476] GetFileType (hFile=0x228) returned 0x1 [0046.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0046.476] GetFileType (hFile=0x228) returned 0x1 [0046.977] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0046.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0046.978] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0046.978] GetFileType (hFile=0x23c) returned 0x1 [0046.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0046.978] GetFileType (hFile=0x23c) returned 0x1 [0046.978] ReadFile (in: hFile=0x23c, lpBuffer=0x224bad0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224bad0*, lpNumberOfBytesRead=0x2edf68*=0xa40, lpOverlapped=0x0) returned 1 [0046.999] ReadFile (in: hFile=0x23c, lpBuffer=0x224b8f8, nNumberOfBytesToRead=0x1c0, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224b8f8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0047.000] ReadFile (in: hFile=0x23c, lpBuffer=0x224bad0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x224bad0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0047.000] CloseHandle (hObject=0x23c) returned 1 [0047.000] WriteFile (in: hFile=0x228, lpBuffer=0x2249fd0*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2249fd0*, lpNumberOfBytesWritten=0x2ede38*=0xa70, lpOverlapped=0x0) returned 1 [0047.001] CloseHandle (hObject=0x228) returned 1 [0047.002] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0047.002] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0047.002] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0047.002] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0047.003] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0047.012] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.012] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.013] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0047.013] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0047.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0047.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0047.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0047.014] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us", lpFilePart=0x0) returned 0x4b [0047.014] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\", lpFilePart=0x0) returned 0x4c [0047.014] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e40290 [0047.015] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0047.015] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0047.015] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0047.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0047.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0047.016] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0047.016] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", dwFileAttributes=0x80) returned 1 [0047.019] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.Horsuke", lpFilePart=0x0) returned 0x61 [0047.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0047.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0047.019] GetFileType (hFile=0x228) returned 0x1 [0047.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0047.019] GetFileType (hFile=0x228) returned 0x1 [0047.513] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0047.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0047.513] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0047.513] GetFileType (hFile=0x23c) returned 0x1 [0047.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0047.514] GetFileType (hFile=0x23c) returned 0x1 [0047.514] ReadFile (in: hFile=0x23c, lpBuffer=0x2338d50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2338d50*, lpNumberOfBytesRead=0x2edee8*=0x545, lpOverlapped=0x0) returned 1 [0047.530] ReadFile (in: hFile=0x23c, lpBuffer=0x2338a7d, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2338a7d*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0047.530] ReadFile (in: hFile=0x23c, lpBuffer=0x2338d50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2338d50*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0047.530] CloseHandle (hObject=0x23c) returned 1 [0047.530] WriteFile (in: hFile=0x228, lpBuffer=0x2337228*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2337228*, lpNumberOfBytesWritten=0x2eddb8*=0x570, lpOverlapped=0x0) returned 1 [0047.531] CloseHandle (hObject=0x228) returned 1 [0047.532] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml", lpFilePart=0x0) returned 0x59 [0047.532] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0047.533] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0047.533] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", dwFileAttributes=0x80) returned 1 [0047.534] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Horsuke", lpFilePart=0x0) returned 0x60 [0047.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0047.534] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0047.535] GetFileType (hFile=0x228) returned 0x1 [0047.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0047.535] GetFileType (hFile=0x228) returned 0x1 [0048.059] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0048.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0048.059] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0048.059] GetFileType (hFile=0x23c) returned 0x1 [0048.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0048.059] GetFileType (hFile=0x23c) returned 0x1 [0048.059] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.075] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.076] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.098] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.098] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.099] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.099] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.099] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.099] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.099] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.099] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.100] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.100] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.100] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.100] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.100] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.100] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.101] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.102] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.102] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.102] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.102] WriteFile (in: hFile=0x228, lpBuffer=0x2420150*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2420150*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.102] ReadFile (in: hFile=0x23c, lpBuffer=0x2421c78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2421c78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.105] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.105] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.106] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.107] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.107] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.107] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.107] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.107] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.108] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.108] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.108] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.108] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.108] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.109] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.109] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.109] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.109] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.109] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.110] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.111] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.112] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.113] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.114] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.115] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.115] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.115] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.115] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.116] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.116] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.116] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.116] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.117] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.118] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.119] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.120] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.121] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.121] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.121] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.124] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.124] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.124] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.124] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.125] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.126] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.127] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.128] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.129] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.129] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.129] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.129] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.130] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.131] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.132] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.133] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.134] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.134] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.134] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.134] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.134] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.134] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.135] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.135] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.135] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.135] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.135] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.135] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.136] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.136] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.136] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.136] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.136] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.136] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.137] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.138] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.139] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.139] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.139] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.140] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.140] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.140] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.140] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.140] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.141] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.142] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.143] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.144] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.145] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.145] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.145] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.146] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.147] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.148] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.149] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.149] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.149] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.149] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.150] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0048.150] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2ede78*=0x1000, lpOverlapped=0x0) returned 1 [0048.150] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x975, lpOverlapped=0x0) returned 1 [0048.150] ReadFile (in: hFile=0x23c, lpBuffer=0x2232b6d, nNumberOfBytesToRead=0x28b, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232b6d*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0048.150] ReadFile (in: hFile=0x23c, lpBuffer=0x2232e10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2232e10*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0048.150] WriteFile (in: hFile=0x228, lpBuffer=0x2231510*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2231510*, lpNumberOfBytesWritten=0x2eddb8*=0x9a0, lpOverlapped=0x0) returned 1 [0048.151] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml", lpFilePart=0x0) returned 0x58 [0048.151] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0048.158] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.TXT", lpFilePart=0x0) returned 0x54 [0048.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0048.158] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0048.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0048.159] WriteFile (in: hFile=0x228, lpBuffer=0x22c3978*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22c3978*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0048.160] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.png", lpFilePart=0x0) returned 0x54 [0048.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0048.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0048.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0048.162] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.vbs", lpFilePart=0x0) returned 0x54 [0048.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0048.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0048.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0048.162] WriteFile (in: hFile=0x228, lpBuffer=0x22c8670*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x22c8670*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0048.163] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x80 [0048.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0048.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0048.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0048.163] WriteFile (in: hFile=0x228, lpBuffer=0x22cb0d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22cb0d0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0048.166] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0048.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0048.166] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0048.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0048.167] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0048.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0048.167] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0048.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0048.168] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0048.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0048.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0048.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0048.169] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0048.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0048.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0048.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0048.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0048.170] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0048.170] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0048.170] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.190] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.191] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.191] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.191] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.191] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.191] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.191] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0048.191] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0048.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0048.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0048.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0048.192] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0048.192] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0048.192] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.193] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.194] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.194] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.194] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.194] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.194] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0048.194] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0048.194] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0048.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0048.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0048.195] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0048.195] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", dwFileAttributes=0x80) returned 1 [0048.197] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0048.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0048.197] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0048.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0048.677] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0048.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0048.677] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0048.677] GetFileType (hFile=0x23c) returned 0x1 [0048.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0048.677] GetFileType (hFile=0x23c) returned 0x1 [0048.678] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca750*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0048.691] WriteFile (in: hFile=0x228, lpBuffer=0x23c8c40*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x23c8c40*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0048.691] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca750*, lpNumberOfBytesRead=0x2edf68*=0xb2, lpOverlapped=0x0) returned 1 [0048.692] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca750*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0048.692] CloseHandle (hObject=0x23c) returned 1 [0048.692] WriteFile (in: hFile=0x228, lpBuffer=0x23c8c40*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23c8c40*, lpNumberOfBytesWritten=0x2ede38*=0xe0, lpOverlapped=0x0) returned 1 [0048.692] CloseHandle (hObject=0x228) returned 1 [0048.693] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0048.693] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0048.694] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0048.694] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", dwFileAttributes=0x80) returned 1 [0048.695] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0048.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0048.695] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0048.695] GetFileType (hFile=0x228) returned 0x1 [0048.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0048.695] GetFileType (hFile=0x228) returned 0x1 [0049.178] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0049.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0049.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0049.179] GetFileType (hFile=0x23c) returned 0x1 [0049.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0049.179] GetFileType (hFile=0x23c) returned 0x1 [0049.179] ReadFile (in: hFile=0x23c, lpBuffer=0x22b42e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b42e8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.192] WriteFile (in: hFile=0x228, lpBuffer=0x22b27d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22b27d8*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.192] ReadFile (in: hFile=0x23c, lpBuffer=0x22b42e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b42e8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.214] WriteFile (in: hFile=0x228, lpBuffer=0x22b27d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22b27d8*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.214] ReadFile (in: hFile=0x23c, lpBuffer=0x22b42e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b42e8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.214] WriteFile (in: hFile=0x228, lpBuffer=0x22b27d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22b27d8*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.214] ReadFile (in: hFile=0x23c, lpBuffer=0x22b42e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b42e8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.214] WriteFile (in: hFile=0x228, lpBuffer=0x22b27d8*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22b27d8*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.214] ReadFile (in: hFile=0x23c, lpBuffer=0x22b42e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b42e8*, lpNumberOfBytesRead=0x2edf68*=0x1d4, lpOverlapped=0x0) returned 1 [0049.214] ReadFile (in: hFile=0x23c, lpBuffer=0x22b42e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b42e8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0049.214] CloseHandle (hObject=0x23c) returned 1 [0049.215] WriteFile (in: hFile=0x228, lpBuffer=0x22b27d8*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22b27d8*, lpNumberOfBytesWritten=0x2ede38*=0x200, lpOverlapped=0x0) returned 1 [0049.215] CloseHandle (hObject=0x228) returned 1 [0049.216] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml", lpFilePart=0x0) returned 0x4d [0049.216] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0049.217] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0049.217] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0049.218] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0049.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0049.218] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0049.218] GetFileType (hFile=0x228) returned 0x1 [0049.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0049.218] GetFileType (hFile=0x228) returned 0x1 [0049.687] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0049.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0049.687] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0049.688] GetFileType (hFile=0x23c) returned 0x1 [0049.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0049.688] GetFileType (hFile=0x23c) returned 0x1 [0049.688] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.702] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.702] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.703] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.704] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0049.704] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0049.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x976, lpOverlapped=0x0) returned 1 [0049.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0cae, nNumberOfBytesToRead=0x28a, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0cae*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0049.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0f50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0f50*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0049.704] CloseHandle (hObject=0x23c) returned 1 [0049.704] WriteFile (in: hFile=0x228, lpBuffer=0x239f450*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x239f450*, lpNumberOfBytesWritten=0x2ede38*=0x9a0, lpOverlapped=0x0) returned 1 [0049.705] CloseHandle (hObject=0x228) returned 1 [0049.705] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0049.705] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.708] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0049.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0049.708] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0049.709] GetFileType (hFile=0x228) returned 0x1 [0049.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0049.709] GetFileType (hFile=0x228) returned 0x1 [0049.709] WriteFile (in: hFile=0x228, lpBuffer=0x23b2fd8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23b2fd8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0049.710] CloseHandle (hObject=0x228) returned 1 [0049.710] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0049.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0049.710] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0049.711] GetFileType (hFile=0x228) returned 0x1 [0049.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0049.711] GetFileType (hFile=0x228) returned 0x1 [0049.711] WriteFile (in: hFile=0x228, lpBuffer=0x23b4098*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23b4098*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0049.711] CloseHandle (hObject=0x228) returned 1 [0049.712] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0049.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0049.712] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0049.712] GetFileType (hFile=0x228) returned 0x1 [0049.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0049.712] GetFileType (hFile=0x228) returned 0x1 [0049.712] WriteFile (in: hFile=0x228, lpBuffer=0x23b7c50*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23b7c50*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0049.713] CloseHandle (hObject=0x228) returned 1 [0049.713] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0049.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0049.713] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0049.713] GetFileType (hFile=0x228) returned 0x1 [0049.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0049.713] GetFileType (hFile=0x228) returned 0x1 [0049.713] WriteFile (in: hFile=0x228, lpBuffer=0x23ba670*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23ba670*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0049.714] CloseHandle (hObject=0x228) returned 1 [0049.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0049.714] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0049.714] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0049.714] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0049.723] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.723] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.723] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.723] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.723] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.723] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.724] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0049.724] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0049.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0049.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0049.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0049.725] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0049.725] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0049.725] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0049.726] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.726] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.726] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.726] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.726] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.726] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0049.727] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0049.728] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0049.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0049.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0049.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0049.728] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", dwFileAttributes=0x80) returned 1 [0049.730] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0049.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0049.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0049.730] GetFileType (hFile=0x228) returned 0x1 [0049.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0049.730] GetFileType (hFile=0x228) returned 0x1 [0050.189] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0050.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0050.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0050.189] GetFileType (hFile=0x23c) returned 0x1 [0050.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0050.189] GetFileType (hFile=0x23c) returned 0x1 [0050.189] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9020*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0050.195] WriteFile (in: hFile=0x228, lpBuffer=0x22a7510*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22a7510*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0050.196] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9020*, lpNumberOfBytesRead=0x2edf68*=0xb2, lpOverlapped=0x0) returned 1 [0050.196] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9020, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9020*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0050.196] CloseHandle (hObject=0x23c) returned 1 [0050.196] WriteFile (in: hFile=0x228, lpBuffer=0x22a7510*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22a7510*, lpNumberOfBytesWritten=0x2ede38*=0xe0, lpOverlapped=0x0) returned 1 [0050.196] CloseHandle (hObject=0x228) returned 1 [0050.197] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0050.197] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0050.198] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0050.198] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", dwFileAttributes=0x80) returned 1 [0050.199] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.Horsuke", lpFilePart=0x0) returned 0x54 [0050.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0050.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0050.200] GetFileType (hFile=0x228) returned 0x1 [0050.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0050.200] GetFileType (hFile=0x228) returned 0x1 [0050.718] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0050.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0050.718] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0050.719] GetFileType (hFile=0x23c) returned 0x1 [0050.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0050.719] GetFileType (hFile=0x23c) returned 0x1 [0050.719] ReadFile (in: hFile=0x23c, lpBuffer=0x2392480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2392480*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0050.726] ReadFile (in: hFile=0x23c, lpBuffer=0x2392480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2392480*, lpNumberOfBytesRead=0x2edf68*=0x915, lpOverlapped=0x0) returned 1 [0050.726] ReadFile (in: hFile=0x23c, lpBuffer=0x239217d, nNumberOfBytesToRead=0x2eb, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x239217d*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0050.726] ReadFile (in: hFile=0x23c, lpBuffer=0x2392480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2392480*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0050.726] CloseHandle (hObject=0x23c) returned 1 [0050.726] WriteFile (in: hFile=0x228, lpBuffer=0x2390970*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2390970*, lpNumberOfBytesWritten=0x2ede38*=0x940, lpOverlapped=0x0) returned 1 [0050.727] CloseHandle (hObject=0x228) returned 1 [0050.727] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml", lpFilePart=0x0) returned 0x4c [0050.727] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0050.728] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0050.728] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0050.730] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0050.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0050.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0050.730] GetFileType (hFile=0x228) returned 0x1 [0050.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0050.730] GetFileType (hFile=0x228) returned 0x1 [0051.202] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0051.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0051.202] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0051.203] GetFileType (hFile=0x23c) returned 0x1 [0051.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0051.203] GetFileType (hFile=0x23c) returned 0x1 [0051.203] ReadFile (in: hFile=0x23c, lpBuffer=0x227be90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227be90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0051.222] ReadFile (in: hFile=0x23c, lpBuffer=0x227be90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227be90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0051.222] ReadFile (in: hFile=0x23c, lpBuffer=0x227be90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227be90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0051.222] ReadFile (in: hFile=0x23c, lpBuffer=0x227be90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227be90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0051.222] ReadFile (in: hFile=0x23c, lpBuffer=0x227be90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227be90*, lpNumberOfBytesRead=0x2edf68*=0x12b, lpOverlapped=0x0) returned 1 [0051.223] ReadFile (in: hFile=0x23c, lpBuffer=0x227be90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227be90*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0051.223] CloseHandle (hObject=0x23c) returned 1 [0051.223] WriteFile (in: hFile=0x228, lpBuffer=0x227a390*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x227a390*, lpNumberOfBytesWritten=0x2ede38*=0x150, lpOverlapped=0x0) returned 1 [0051.223] CloseHandle (hObject=0x228) returned 1 [0051.224] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0051.224] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0051.227] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0051.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0051.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0051.227] GetFileType (hFile=0x228) returned 0x1 [0051.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0051.227] GetFileType (hFile=0x228) returned 0x1 [0051.228] WriteFile (in: hFile=0x228, lpBuffer=0x228a570*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x228a570*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0051.228] CloseHandle (hObject=0x228) returned 1 [0051.229] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0051.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0051.229] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0051.229] GetFileType (hFile=0x228) returned 0x1 [0051.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0051.229] GetFileType (hFile=0x228) returned 0x1 [0051.230] WriteFile (in: hFile=0x228, lpBuffer=0x228b630*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x228b630*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0051.230] CloseHandle (hObject=0x228) returned 1 [0051.231] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0051.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0051.231] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0051.231] GetFileType (hFile=0x228) returned 0x1 [0051.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0051.231] GetFileType (hFile=0x228) returned 0x1 [0051.231] WriteFile (in: hFile=0x228, lpBuffer=0x228f1e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x228f1e8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0051.232] CloseHandle (hObject=0x228) returned 1 [0051.232] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0051.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0051.232] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0051.245] GetFileType (hFile=0x228) returned 0x1 [0051.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0051.245] GetFileType (hFile=0x228) returned 0x1 [0051.245] WriteFile (in: hFile=0x228, lpBuffer=0x2291c08*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2291c08*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0051.246] CloseHandle (hObject=0x228) returned 1 [0051.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0051.247] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0051.247] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0051.247] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.289] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.290] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.290] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.290] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.290] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.290] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.290] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0051.290] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0051.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0051.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0051.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0051.291] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C", lpFilePart=0x0) returned 0x3e [0051.291] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\", lpFilePart=0x0) returned 0x3f [0051.291] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e40290 [0051.292] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.292] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.292] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.292] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.292] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.292] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0051.293] FindNextFileW (in: hFindFile=0x1e40290, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0051.293] FindClose (in: hFindFile=0x1e40290 | out: hFindFile=0x1e40290) returned 1 [0051.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0051.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0051.294] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0051.294] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", dwFileAttributes=0x80) returned 1 [0051.296] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke", lpFilePart=0x0) returned 0x55 [0051.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0051.296] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0051.296] GetFileType (hFile=0x228) returned 0x1 [0051.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0051.296] GetFileType (hFile=0x228) returned 0x1 [0051.787] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0051.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0051.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0051.788] GetFileType (hFile=0x23c) returned 0x1 [0051.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0051.788] GetFileType (hFile=0x23c) returned 0x1 [0051.788] ReadFile (in: hFile=0x23c, lpBuffer=0x237e550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237e550*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0051.810] ReadFile (in: hFile=0x23c, lpBuffer=0x237e550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237e550*, lpNumberOfBytesRead=0x2edf68*=0xb2, lpOverlapped=0x0) returned 1 [0051.810] ReadFile (in: hFile=0x23c, lpBuffer=0x237e550, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237e550*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0051.810] CloseHandle (hObject=0x23c) returned 1 [0051.810] CloseHandle (hObject=0x228) returned 1 [0051.811] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml", lpFilePart=0x0) returned 0x4d [0051.811] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0051.812] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0051.812] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", dwFileAttributes=0x80) returned 1 [0051.813] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke", lpFilePart=0x0) returned 0x50 [0051.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0051.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0051.813] GetFileType (hFile=0x228) returned 0x1 [0051.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0051.813] GetFileType (hFile=0x228) returned 0x1 [0052.481] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0052.481] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0052.481] GetFileType (hFile=0x23c) returned 0x1 [0052.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0052.481] GetFileType (hFile=0x23c) returned 0x1 [0052.481] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0052.486] WriteFile (in: hFile=0x228, lpBuffer=0x2264648*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2264648*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0052.487] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0052.487] WriteFile (in: hFile=0x228, lpBuffer=0x2264648*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2264648*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0052.487] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0052.487] WriteFile (in: hFile=0x228, lpBuffer=0x2264648*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2264648*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0052.487] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0052.488] WriteFile (in: hFile=0x228, lpBuffer=0x2264648*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2264648*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0052.488] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0052.488] WriteFile (in: hFile=0x228, lpBuffer=0x2264648*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2264648*, lpNumberOfBytesWritten=0x2edef8*=0x1000, lpOverlapped=0x0) returned 1 [0052.488] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x61, lpOverlapped=0x0) returned 1 [0052.488] ReadFile (in: hFile=0x23c, lpBuffer=0x2266148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2266148*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0052.488] CloseHandle (hObject=0x23c) returned 1 [0052.488] WriteFile (in: hFile=0x228, lpBuffer=0x2264648*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2264648*, lpNumberOfBytesWritten=0x2ede38*=0x90, lpOverlapped=0x0) returned 1 [0052.488] CloseHandle (hObject=0x228) returned 1 [0052.489] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml", lpFilePart=0x0) returned 0x48 [0052.489] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0052.490] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0052.490] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", dwFileAttributes=0x80) returned 1 [0052.492] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.Horsuke", lpFilePart=0x0) returned 0x53 [0052.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0052.492] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.Horsuke" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0052.492] GetFileType (hFile=0x228) returned 0x1 [0052.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0052.492] GetFileType (hFile=0x228) returned 0x1 [0053.014] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0053.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0053.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0053.014] GetFileType (hFile=0x15c) returned 0x1 [0053.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.014] GetFileType (hFile=0x15c) returned 0x1 [0053.014] ReadFile (in: hFile=0x15c, lpBuffer=0x2330f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2330f78*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0053.031] ReadFile (in: hFile=0x15c, lpBuffer=0x2330f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2330f78*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0053.032] ReadFile (in: hFile=0x15c, lpBuffer=0x2330f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2330f78*, lpNumberOfBytesRead=0x2edf68*=0x213, lpOverlapped=0x0) returned 1 [0053.032] ReadFile (in: hFile=0x15c, lpBuffer=0x2330f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2330f78*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0053.032] CloseHandle (hObject=0x15c) returned 1 [0053.032] CloseHandle (hObject=0x228) returned 1 [0053.033] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml", lpFilePart=0x0) returned 0x4b [0053.033] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0053.036] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0053.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.036] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.TXT" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.036] GetFileType (hFile=0x228) returned 0x1 [0053.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.036] GetFileType (hFile=0x228) returned 0x1 [0053.036] WriteFile (in: hFile=0x228, lpBuffer=0x233d690*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x233d690*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.037] CloseHandle (hObject=0x228) returned 1 [0053.037] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.png", lpFilePart=0x0) returned 0x47 [0053.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.037] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.png" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.038] GetFileType (hFile=0x228) returned 0x1 [0053.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.038] GetFileType (hFile=0x228) returned 0x1 [0053.038] WriteFile (in: hFile=0x228, lpBuffer=0x233e750*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x233e750*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.038] CloseHandle (hObject=0x228) returned 1 [0053.039] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0053.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Hack.vbs" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.039] GetFileType (hFile=0x228) returned 0x1 [0053.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.039] GetFileType (hFile=0x228) returned 0x1 [0053.039] WriteFile (in: hFile=0x228, lpBuffer=0x2342308*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2342308*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.040] CloseHandle (hObject=0x228) returned 1 [0053.040] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0053.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.040] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.041] GetFileType (hFile=0x228) returned 0x1 [0053.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.041] GetFileType (hFile=0x228) returned 0x1 [0053.041] WriteFile (in: hFile=0x228, lpBuffer=0x2344d28*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2344d28*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.042] CloseHandle (hObject=0x228) returned 1 [0053.044] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\Hack.TXT", lpFilePart=0x0) returned 0x1e [0053.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.044] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\Hack.TXT" (normalized: "c:\\msocache\\all users\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.044] GetFileType (hFile=0x228) returned 0x1 [0053.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.044] GetFileType (hFile=0x228) returned 0x1 [0053.044] WriteFile (in: hFile=0x228, lpBuffer=0x234ef90*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x234ef90*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.045] CloseHandle (hObject=0x228) returned 1 [0053.045] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\Hack.png", lpFilePart=0x0) returned 0x1e [0053.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\Hack.png" (normalized: "c:\\msocache\\all users\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.045] GetFileType (hFile=0x228) returned 0x1 [0053.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.045] GetFileType (hFile=0x228) returned 0x1 [0053.045] WriteFile (in: hFile=0x228, lpBuffer=0x2350000*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2350000*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.046] CloseHandle (hObject=0x228) returned 1 [0053.046] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\Hack.vbs", lpFilePart=0x0) returned 0x1e [0053.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.046] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\Hack.vbs" (normalized: "c:\\msocache\\all users\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.046] GetFileType (hFile=0x228) returned 0x1 [0053.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.047] GetFileType (hFile=0x228) returned 0x1 [0053.047] WriteFile (in: hFile=0x228, lpBuffer=0x2353ac8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x2353ac8*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.047] CloseHandle (hObject=0x228) returned 1 [0053.047] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\All Users\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\All Users\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4a [0053.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\all users\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.048] GetFileType (hFile=0x228) returned 0x1 [0053.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.048] GetFileType (hFile=0x228) returned 0x1 [0053.048] WriteFile (in: hFile=0x228, lpBuffer=0x2356448*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2356448*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.049] CloseHandle (hObject=0x228) returned 1 [0053.049] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\Hack.TXT", lpFilePart=0x0) returned 0x14 [0053.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0053.049] CreateFileW (lpFileName="C:\\MSOCache\\Hack.TXT" (normalized: "c:\\msocache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.050] GetFileType (hFile=0x228) returned 0x1 [0053.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0053.050] GetFileType (hFile=0x228) returned 0x1 [0053.050] WriteFile (in: hFile=0x228, lpBuffer=0x2360690*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2360690*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0053.050] CloseHandle (hObject=0x228) returned 1 [0053.051] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\Hack.png", lpFilePart=0x0) returned 0x14 [0053.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.051] CreateFileW (lpFileName="C:\\MSOCache\\Hack.png" (normalized: "c:\\msocache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.051] GetFileType (hFile=0x228) returned 0x1 [0053.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0053.051] GetFileType (hFile=0x228) returned 0x1 [0053.051] WriteFile (in: hFile=0x228, lpBuffer=0x23616f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x23616f0*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0053.052] CloseHandle (hObject=0x228) returned 1 [0053.052] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\Hack.vbs", lpFilePart=0x0) returned 0x14 [0053.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0053.052] CreateFileW (lpFileName="C:\\MSOCache\\Hack.vbs" (normalized: "c:\\msocache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.052] GetFileType (hFile=0x228) returned 0x1 [0053.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0053.052] GetFileType (hFile=0x228) returned 0x1 [0053.052] WriteFile (in: hFile=0x228, lpBuffer=0x2365188*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x2365188*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0053.053] CloseHandle (hObject=0x228) returned 1 [0053.053] GetFullPathNameW (in: lpFileName="C:\\MSOCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\MSOCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x40 [0053.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0053.053] CreateFileW (lpFileName="C:\\MSOCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\msocache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.055] GetFileType (hFile=0x228) returned 0x1 [0053.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0053.055] GetFileType (hFile=0x228) returned 0x1 [0053.055] WriteFile (in: hFile=0x228, lpBuffer=0x2367ae8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2367ae8*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0053.056] CloseHandle (hObject=0x228) returned 1 [0053.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0053.056] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0053.056] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0053.056] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0053.057] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0053.057] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0053.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0053.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0053.057] GetFullPathNameW (in: lpFileName="C:\\PerfLogs", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs", lpFilePart=0x0) returned 0xb [0053.057] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\", lpFilePart=0x0) returned 0xc [0053.057] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0053.057] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.057] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0053.058] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0053.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0053.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.058] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0053.058] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0053.058] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.058] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.058] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.058] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.058] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin", lpFilePart=0x0) returned 0x11 [0053.059] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\", lpFilePart=0x0) returned 0x12 [0053.059] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\Admin\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.059] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.059] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.059] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.059] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\Hack.TXT", lpFilePart=0x0) returned 0x1a [0053.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.059] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\Hack.TXT" (normalized: "c:\\perflogs\\admin\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.059] GetFileType (hFile=0x228) returned 0x1 [0053.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.060] GetFileType (hFile=0x228) returned 0x1 [0053.060] WriteFile (in: hFile=0x228, lpBuffer=0x2374aa8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2374aa8*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.060] CloseHandle (hObject=0x228) returned 1 [0053.061] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\Hack.png", lpFilePart=0x0) returned 0x1a [0053.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.061] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\Hack.png" (normalized: "c:\\perflogs\\admin\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.061] GetFileType (hFile=0x228) returned 0x1 [0053.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.061] GetFileType (hFile=0x228) returned 0x1 [0053.061] WriteFile (in: hFile=0x228, lpBuffer=0x2375b10*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2375b10*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.062] CloseHandle (hObject=0x228) returned 1 [0053.062] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\Hack.vbs", lpFilePart=0x0) returned 0x1a [0053.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.062] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\Hack.vbs" (normalized: "c:\\perflogs\\admin\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.062] GetFileType (hFile=0x228) returned 0x1 [0053.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.062] GetFileType (hFile=0x228) returned 0x1 [0053.062] WriteFile (in: hFile=0x228, lpBuffer=0x23795c0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x23795c0*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.063] CloseHandle (hObject=0x228) returned 1 [0053.063] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Admin\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Admin\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x46 [0053.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.063] CreateFileW (lpFileName="C:\\PerfLogs\\Admin\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\perflogs\\admin\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.064] GetFileType (hFile=0x228) returned 0x1 [0053.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.064] GetFileType (hFile=0x228) returned 0x1 [0053.064] WriteFile (in: hFile=0x228, lpBuffer=0x237bf30*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x237bf30*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.065] CloseHandle (hObject=0x228) returned 1 [0053.065] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Hack.TXT", lpFilePart=0x0) returned 0x14 [0053.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0053.065] CreateFileW (lpFileName="C:\\PerfLogs\\Hack.TXT" (normalized: "c:\\perflogs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.066] GetFileType (hFile=0x228) returned 0x1 [0053.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0053.066] GetFileType (hFile=0x228) returned 0x1 [0053.066] WriteFile (in: hFile=0x228, lpBuffer=0x2386178*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x2386178*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0053.066] CloseHandle (hObject=0x228) returned 1 [0053.067] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Hack.png", lpFilePart=0x0) returned 0x14 [0053.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.067] CreateFileW (lpFileName="C:\\PerfLogs\\Hack.png" (normalized: "c:\\perflogs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.067] GetFileType (hFile=0x228) returned 0x1 [0053.067] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0053.067] GetFileType (hFile=0x228) returned 0x1 [0053.067] WriteFile (in: hFile=0x228, lpBuffer=0x23871d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x23871d8*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0053.068] CloseHandle (hObject=0x228) returned 1 [0053.068] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\Hack.vbs", lpFilePart=0x0) returned 0x14 [0053.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0053.068] CreateFileW (lpFileName="C:\\PerfLogs\\Hack.vbs" (normalized: "c:\\perflogs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.068] GetFileType (hFile=0x228) returned 0x1 [0053.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0053.068] GetFileType (hFile=0x228) returned 0x1 [0053.069] WriteFile (in: hFile=0x228, lpBuffer=0x238ac70*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x238ac70*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0053.069] CloseHandle (hObject=0x228) returned 1 [0053.069] GetFullPathNameW (in: lpFileName="C:\\PerfLogs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\PerfLogs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x40 [0053.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0053.070] CreateFileW (lpFileName="C:\\PerfLogs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\perflogs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.071] GetFileType (hFile=0x228) returned 0x1 [0053.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0053.072] GetFileType (hFile=0x228) returned 0x1 [0053.072] WriteFile (in: hFile=0x228, lpBuffer=0x238d5d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x238d5d0*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0053.072] CloseHandle (hObject=0x228) returned 1 [0053.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0053.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0053.073] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0053.073] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0053.074] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0053.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0053.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0053.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData", lpFilePart=0x0) returned 0xe [0053.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\", lpFilePart=0x0) returned 0xf [0053.075] FindFirstFileW (in: lpFileName="C:\\ProgramData\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0053.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0053.076] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0053.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0053.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0053.076] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15 [0053.076] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.077] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe", lpFilePart=0x0) returned 0x14 [0053.077] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\", lpFilePart=0x0) returned 0x15 [0053.077] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.078] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0053.078] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d [0053.078] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.078] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.078] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.079] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.079] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x1c [0053.079] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x1d [0053.079] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.079] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.079] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.079] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.079] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0053.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22 [0053.080] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.080] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.080] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.080] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.080] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x21 [0053.080] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x22 [0053.080] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.080] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.081] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.081] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.081] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0053.081] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c [0053.081] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.093] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.094] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2b [0053.094] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x2c [0053.094] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.094] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0053.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35 [0053.095] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0053.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0053.095] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0053.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0053.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x34 [0053.095] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x35 [0053.095] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0053.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.096] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.096] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0053.096] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0053.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0053.096] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.TXT", lpFilePart=0x0) returned 0x3d [0053.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0053.096] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0053.100] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", lpFilePart=0x0) returned 0x3d [0053.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0053.100] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0053.101] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.vbs", lpFilePart=0x0) returned 0x3d [0053.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0053.101] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0053.102] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x69 [0053.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0053.102] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\security\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0053.105] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.TXT", lpFilePart=0x0) returned 0x34 [0053.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.105] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.106] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", lpFilePart=0x0) returned 0x34 [0053.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.106] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.107] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.vbs", lpFilePart=0x0) returned 0x34 [0053.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.107] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.108] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x60 [0053.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.108] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Replicate\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\replicate\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.113] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.TXT", lpFilePart=0x0) returned 0x2a [0053.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.113] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.114] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x2a [0053.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.114] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.115] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.vbs", lpFilePart=0x0) returned 0x2a [0053.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.115] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.116] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x56 [0053.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.116] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\acrobat\\10.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.118] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0053.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.118] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\acrobat\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.119] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x25 [0053.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.119] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\programdata\\adobe\\acrobat\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.120] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0053.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.120] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\acrobat\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.121] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0053.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.122] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\acrobat\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0053.125] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x19 [0053.126] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.126] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM", lpFilePart=0x0) returned 0x18 [0053.126] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x19 [0053.126] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.127] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0053.127] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x27 [0053.127] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.135] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.135] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.135] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.135] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.135] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.135] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x26 [0053.136] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x27 [0053.136] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.137] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.138] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.TXT", lpFilePart=0x0) returned 0x2f [0053.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.138] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.140] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", lpFilePart=0x0) returned 0x2f [0053.140] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.140] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.png" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.141] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.vbs", lpFilePart=0x0) returned 0x2f [0053.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.141] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.142] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5b [0053.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.142] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.143] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Hack.TXT", lpFilePart=0x0) returned 0x21 [0053.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.143] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\arm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.144] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Hack.png", lpFilePart=0x0) returned 0x21 [0053.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.144] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.png" (normalized: "c:\\programdata\\adobe\\arm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.145] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\Hack.vbs", lpFilePart=0x0) returned 0x21 [0053.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.145] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\arm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.146] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\ARM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\ARM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4d [0053.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.146] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\arm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.148] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Hack.TXT", lpFilePart=0x0) returned 0x1d [0053.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.149] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Hack.TXT" (normalized: "c:\\programdata\\adobe\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.150] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x1d [0053.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.150] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Hack.png" (normalized: "c:\\programdata\\adobe\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.151] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\Hack.vbs", lpFilePart=0x0) returned 0x1d [0053.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.151] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\Hack.vbs" (normalized: "c:\\programdata\\adobe\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.152] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x49 [0053.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.152] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\adobe\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data", lpFilePart=0x0) returned 0x1f [0053.154] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\", lpFilePart=0x0) returned 0x20 [0053.154] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Application Data\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0xffffffffffffffff [0053.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf40) returned 1 [0053.160] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\Hack.TXT", lpFilePart=0x0) returned 0x28 [0053.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.160] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Hack.TXT" (normalized: "c:\\programdata\\application data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.160] GetFileType (hFile=0x228) returned 0x1 [0053.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.160] GetFileType (hFile=0x228) returned 0x1 [0053.161] WriteFile (in: hFile=0x228, lpBuffer=0x2225838*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2225838*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.162] CloseHandle (hObject=0x228) returned 1 [0053.162] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\Hack.png", lpFilePart=0x0) returned 0x28 [0053.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.162] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Hack.png" (normalized: "c:\\programdata\\application data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.162] GetFileType (hFile=0x228) returned 0x1 [0053.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.162] GetFileType (hFile=0x228) returned 0x1 [0053.162] WriteFile (in: hFile=0x228, lpBuffer=0x22268c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x22268c0*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.163] CloseHandle (hObject=0x228) returned 1 [0053.163] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\Hack.vbs", lpFilePart=0x0) returned 0x28 [0053.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.163] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\Hack.vbs" (normalized: "c:\\programdata\\application data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.164] GetFileType (hFile=0x228) returned 0x1 [0053.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.164] GetFileType (hFile=0x228) returned 0x1 [0053.164] WriteFile (in: hFile=0x228, lpBuffer=0x222a3d0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x222a3d0*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.164] CloseHandle (hObject=0x228) returned 1 [0053.165] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x54 [0053.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.165] CreateFileW (lpFileName="C:\\ProgramData\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\application data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.165] GetFileType (hFile=0x228) returned 0x1 [0053.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.165] GetFileType (hFile=0x228) returned 0x1 [0053.165] WriteFile (in: hFile=0x228, lpBuffer=0x222cd80*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x222cd80*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.166] CloseHandle (hObject=0x228) returned 1 [0053.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.166] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop", lpFilePart=0x0) returned 0x16 [0053.166] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\", lpFilePart=0x0) returned 0x17 [0053.166] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Desktop\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0xffffffffffffffff [0053.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf40) returned 1 [0053.170] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\Hack.TXT", lpFilePart=0x0) returned 0x1f [0053.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.170] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Hack.TXT" (normalized: "c:\\programdata\\desktop\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.171] GetFileType (hFile=0x228) returned 0x1 [0053.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.171] GetFileType (hFile=0x228) returned 0x1 [0053.171] WriteFile (in: hFile=0x228, lpBuffer=0x22381d0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22381d0*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.172] CloseHandle (hObject=0x228) returned 1 [0053.172] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\Hack.png", lpFilePart=0x0) returned 0x1f [0053.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.172] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Hack.png" (normalized: "c:\\programdata\\desktop\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.173] GetFileType (hFile=0x228) returned 0x1 [0053.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.173] GetFileType (hFile=0x228) returned 0x1 [0053.173] WriteFile (in: hFile=0x228, lpBuffer=0x2239240*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2239240*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.174] CloseHandle (hObject=0x228) returned 1 [0053.174] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\Hack.vbs", lpFilePart=0x0) returned 0x1f [0053.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.174] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\Hack.vbs" (normalized: "c:\\programdata\\desktop\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.175] GetFileType (hFile=0x228) returned 0x1 [0053.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.175] GetFileType (hFile=0x228) returned 0x1 [0053.175] WriteFile (in: hFile=0x228, lpBuffer=0x223cd08*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x223cd08*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.175] CloseHandle (hObject=0x228) returned 1 [0053.176] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4b [0053.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.176] CreateFileW (lpFileName="C:\\ProgramData\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\desktop\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.176] GetFileType (hFile=0x228) returned 0x1 [0053.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.176] GetFileType (hFile=0x228) returned 0x1 [0053.177] WriteFile (in: hFile=0x228, lpBuffer=0x223f688*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x223f688*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.177] CloseHandle (hObject=0x228) returned 1 [0053.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents", lpFilePart=0x0) returned 0x18 [0053.178] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\", lpFilePart=0x0) returned 0x19 [0053.178] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Documents\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0xffffffffffffffff [0053.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf40) returned 1 [0053.182] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\Hack.TXT", lpFilePart=0x0) returned 0x21 [0053.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.182] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\Hack.TXT" (normalized: "c:\\programdata\\documents\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.182] GetFileType (hFile=0x228) returned 0x1 [0053.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.182] GetFileType (hFile=0x228) returned 0x1 [0053.182] WriteFile (in: hFile=0x228, lpBuffer=0x224ab10*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x224ab10*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.183] CloseHandle (hObject=0x228) returned 1 [0053.183] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\Hack.png", lpFilePart=0x0) returned 0x21 [0053.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.184] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\Hack.png" (normalized: "c:\\programdata\\documents\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.184] GetFileType (hFile=0x228) returned 0x1 [0053.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.184] GetFileType (hFile=0x228) returned 0x1 [0053.184] WriteFile (in: hFile=0x228, lpBuffer=0x224bb88*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x224bb88*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.185] CloseHandle (hObject=0x228) returned 1 [0053.185] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\Hack.vbs", lpFilePart=0x0) returned 0x21 [0053.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.185] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\Hack.vbs" (normalized: "c:\\programdata\\documents\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.185] GetFileType (hFile=0x228) returned 0x1 [0053.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.185] GetFileType (hFile=0x228) returned 0x1 [0053.186] WriteFile (in: hFile=0x228, lpBuffer=0x224f668*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x224f668*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.186] CloseHandle (hObject=0x228) returned 1 [0053.186] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4d [0053.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.186] CreateFileW (lpFileName="C:\\ProgramData\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\documents\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.187] GetFileType (hFile=0x228) returned 0x1 [0053.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.187] GetFileType (hFile=0x228) returned 0x1 [0053.187] WriteFile (in: hFile=0x228, lpBuffer=0x2251ff8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2251ff8*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.188] CloseHandle (hObject=0x228) returned 1 [0053.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites", lpFilePart=0x0) returned 0x18 [0053.188] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\", lpFilePart=0x0) returned 0x19 [0053.188] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Favorites\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0xffffffffffffffff [0053.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf40) returned 1 [0053.191] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\Hack.TXT", lpFilePart=0x0) returned 0x21 [0053.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.192] CreateFileW (lpFileName="C:\\ProgramData\\Favorites\\Hack.TXT" (normalized: "c:\\programdata\\favorites\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.192] GetFileType (hFile=0x228) returned 0x1 [0053.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.192] GetFileType (hFile=0x228) returned 0x1 [0053.192] WriteFile (in: hFile=0x228, lpBuffer=0x225d480*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x225d480*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.193] CloseHandle (hObject=0x228) returned 1 [0053.193] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\Hack.png", lpFilePart=0x0) returned 0x21 [0053.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.193] CreateFileW (lpFileName="C:\\ProgramData\\Favorites\\Hack.png" (normalized: "c:\\programdata\\favorites\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.194] GetFileType (hFile=0x228) returned 0x1 [0053.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.194] GetFileType (hFile=0x228) returned 0x1 [0053.194] WriteFile (in: hFile=0x228, lpBuffer=0x225e4f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x225e4f8*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.195] CloseHandle (hObject=0x228) returned 1 [0053.195] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\Hack.vbs", lpFilePart=0x0) returned 0x21 [0053.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.195] CreateFileW (lpFileName="C:\\ProgramData\\Favorites\\Hack.vbs" (normalized: "c:\\programdata\\favorites\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.195] GetFileType (hFile=0x228) returned 0x1 [0053.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.196] GetFileType (hFile=0x228) returned 0x1 [0053.196] WriteFile (in: hFile=0x228, lpBuffer=0x2261fd8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x2261fd8*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.196] CloseHandle (hObject=0x228) returned 1 [0053.197] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4d [0053.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.197] CreateFileW (lpFileName="C:\\ProgramData\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\favorites\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.198] GetFileType (hFile=0x228) returned 0x1 [0053.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.198] GetFileType (hFile=0x228) returned 0x1 [0053.198] WriteFile (in: hFile=0x228, lpBuffer=0x2264968*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2264968*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.199] CloseHandle (hObject=0x228) returned 1 [0053.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0053.199] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19 [0053.199] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.200] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.203] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.203] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft", lpFilePart=0x0) returned 0x18 [0053.203] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\", lpFilePart=0x0) returned 0x19 [0053.203] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0053.206] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24 [0053.206] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.207] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x23 [0053.207] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x24 [0053.207] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.208] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0053.208] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b [0053.208] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.209] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2a [0053.209] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2b [0053.209] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.209] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0053.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f [0053.210] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.210] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x2e [0053.210] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x2f [0053.210] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.211] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0053.211] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35 [0053.211] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0053.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0053.214] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0053.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0053.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x34 [0053.215] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x35 [0053.215] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0053.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0053.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0053.216] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0053.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0053.217] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.TXT", lpFilePart=0x0) returned 0x3d [0053.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0053.217] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.218] GetFileType (hFile=0x228) returned 0x1 [0053.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0053.218] GetFileType (hFile=0x228) returned 0x1 [0053.218] WriteFile (in: hFile=0x228, lpBuffer=0x227e168*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x227e168*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.219] CloseHandle (hObject=0x228) returned 1 [0053.219] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", lpFilePart=0x0) returned 0x3d [0053.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0053.219] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.220] GetFileType (hFile=0x228) returned 0x1 [0053.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0053.220] GetFileType (hFile=0x228) returned 0x1 [0053.220] WriteFile (in: hFile=0x228, lpBuffer=0x227f218*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x227f218*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0053.221] CloseHandle (hObject=0x228) returned 1 [0053.221] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.vbs", lpFilePart=0x0) returned 0x3d [0053.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0053.221] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.221] GetFileType (hFile=0x228) returned 0x1 [0053.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0053.221] GetFileType (hFile=0x228) returned 0x1 [0053.221] WriteFile (in: hFile=0x228, lpBuffer=0x2282da0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2282da0*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0053.222] CloseHandle (hObject=0x228) returned 1 [0053.222] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x69 [0053.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0053.222] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.222] GetFileType (hFile=0x228) returned 0x1 [0053.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0053.222] GetFileType (hFile=0x228) returned 0x1 [0053.223] WriteFile (in: hFile=0x228, lpBuffer=0x22857a0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22857a0*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.223] CloseHandle (hObject=0x228) returned 1 [0053.224] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0053.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.224] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.224] GetFileType (hFile=0x228) returned 0x1 [0053.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.224] GetFileType (hFile=0x228) returned 0x1 [0053.224] WriteFile (in: hFile=0x228, lpBuffer=0x228fa68*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x228fa68*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.225] CloseHandle (hObject=0x228) returned 1 [0053.227] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", lpFilePart=0x0) returned 0x37 [0053.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.227] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.png" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.228] GetFileType (hFile=0x228) returned 0x1 [0053.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.228] GetFileType (hFile=0x228) returned 0x1 [0053.228] WriteFile (in: hFile=0x228, lpBuffer=0x2290b08*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2290b08*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.229] CloseHandle (hObject=0x228) returned 1 [0053.229] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0053.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.229] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.230] GetFileType (hFile=0x228) returned 0x1 [0053.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.230] GetFileType (hFile=0x228) returned 0x1 [0053.230] WriteFile (in: hFile=0x228, lpBuffer=0x2294660*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2294660*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.230] CloseHandle (hObject=0x228) returned 1 [0053.231] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0053.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.231] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.232] GetFileType (hFile=0x228) returned 0x1 [0053.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.232] GetFileType (hFile=0x228) returned 0x1 [0053.232] WriteFile (in: hFile=0x228, lpBuffer=0x2297040*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2297040*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.233] CloseHandle (hObject=0x228) returned 1 [0053.233] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0053.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.233] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.234] GetFileType (hFile=0x228) returned 0x1 [0053.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.234] GetFileType (hFile=0x228) returned 0x1 [0053.234] WriteFile (in: hFile=0x228, lpBuffer=0x22a12f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22a12f8*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.235] CloseHandle (hObject=0x228) returned 1 [0053.235] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.png", lpFilePart=0x0) returned 0x33 [0053.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.235] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.png" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.235] GetFileType (hFile=0x228) returned 0x1 [0053.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.235] GetFileType (hFile=0x228) returned 0x1 [0053.235] WriteFile (in: hFile=0x228, lpBuffer=0x22a2390*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22a2390*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.236] CloseHandle (hObject=0x228) returned 1 [0053.237] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0053.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.237] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.237] GetFileType (hFile=0x228) returned 0x1 [0053.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.237] GetFileType (hFile=0x228) returned 0x1 [0053.237] WriteFile (in: hFile=0x228, lpBuffer=0x22a5ed0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x22a5ed0*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.238] CloseHandle (hObject=0x228) returned 1 [0053.238] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Client\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0053.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.238] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.239] GetFileType (hFile=0x228) returned 0x1 [0053.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.239] GetFileType (hFile=0x228) returned 0x1 [0053.239] WriteFile (in: hFile=0x228, lpBuffer=0x22a88a0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x22a88a0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.240] CloseHandle (hObject=0x228) returned 1 [0053.240] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0053.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.240] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\assistance\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.241] GetFileType (hFile=0x228) returned 0x1 [0053.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.241] GetFileType (hFile=0x228) returned 0x1 [0053.241] WriteFile (in: hFile=0x228, lpBuffer=0x22b2b48*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22b2b48*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.242] CloseHandle (hObject=0x228) returned 1 [0053.242] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Hack.png", lpFilePart=0x0) returned 0x2c [0053.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.242] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.png" (normalized: "c:\\programdata\\microsoft\\assistance\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.245] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0053.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.245] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\assistance\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.246] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Assistance\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0053.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.246] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\assistance\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.248] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0053.248] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0053.248] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.249] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x1f [0053.249] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x20 [0053.249] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.250] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0053.250] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0053.250] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.251] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.251] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x23 [0053.251] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x24 [0053.251] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.252] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.252] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0053.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0053.252] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.252] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.252] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.252] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x2f [0053.252] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0053.253] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.253] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.253] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.253] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.253] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0053.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.253] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.254] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x38 [0053.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.254] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.255] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0053.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.255] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.256] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0053.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.256] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\machinekeys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.259] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0053.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.259] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.260] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.png", lpFilePart=0x0) returned 0x2c [0053.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.260] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.261] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0053.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.261] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.262] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0053.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.262] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\DSS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\dss\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0053.264] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0053.265] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.265] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x24 [0053.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x25 [0053.266] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.266] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.266] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.266] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.266] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0053.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.266] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.267] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.png", lpFilePart=0x0) returned 0x2d [0053.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.267] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.268] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0053.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.268] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0053.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.269] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Keys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\keys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0053.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0053.270] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.271] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x23 [0053.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x24 [0053.271] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.271] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0053.271] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0053.272] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.272] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x2f [0053.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x30 [0053.272] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.272] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0053.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.273] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x38 [0053.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.274] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.275] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0053.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.275] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.276] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0053.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.276] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\machinekeys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0053.278] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0053.278] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.279] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x2c [0053.279] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x2d [0053.279] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.279] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.280] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.TXT", lpFilePart=0x0) returned 0x35 [0053.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.280] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.282] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", lpFilePart=0x0) returned 0x35 [0053.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.282] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.283] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.vbs", lpFilePart=0x0) returned 0x35 [0053.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.283] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.284] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x61 [0053.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.284] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\S-1-5-18\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\s-1-5-18\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.285] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0053.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.285] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.286] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.png", lpFilePart=0x0) returned 0x2c [0053.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.286] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.287] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0053.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.287] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.288] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0053.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.288] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\rsa\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Hack.TXT", lpFilePart=0x0) returned 0x28 [0053.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.290] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\crypto\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Hack.png", lpFilePart=0x0) returned 0x28 [0053.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.291] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.png" (normalized: "c:\\programdata\\microsoft\\crypto\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\Hack.vbs", lpFilePart=0x0) returned 0x28 [0053.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.293] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\crypto\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.294] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x54 [0053.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.294] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\crypto\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.296] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0053.296] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0053.296] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.296] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.296] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x25 [0053.296] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x26 [0053.296] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.297] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0053.297] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0053.297] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.298] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x2c [0053.298] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x2d [0053.298] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.298] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.298] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0053.299] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0053.299] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.385] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x53 [0053.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x54 [0053.386] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.387] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x62 [0053.388] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x80) returned 0 [0053.405] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0053.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.405] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.406] GetFileType (hFile=0x228) returned 0x1 [0053.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.406] GetFileType (hFile=0x228) returned 0x1 [0053.406] WriteFile (in: hFile=0x228, lpBuffer=0x2355190*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2355190*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.407] CloseHandle (hObject=0x228) returned 1 [0053.407] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.png", lpFilePart=0x0) returned 0x5c [0053.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.407] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.408] GetFileType (hFile=0x228) returned 0x1 [0053.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.408] GetFileType (hFile=0x228) returned 0x1 [0053.408] WriteFile (in: hFile=0x228, lpBuffer=0x2356280*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2356280*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.409] CloseHandle (hObject=0x228) returned 1 [0053.409] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0053.409] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.409] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.409] GetFileType (hFile=0x228) returned 0x1 [0053.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.409] GetFileType (hFile=0x228) returned 0x1 [0053.409] WriteFile (in: hFile=0x228, lpBuffer=0x2359ec8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2359ec8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.410] CloseHandle (hObject=0x228) returned 1 [0053.410] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0053.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.410] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.411] GetFileType (hFile=0x228) returned 0x1 [0053.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.411] GetFileType (hFile=0x228) returned 0x1 [0053.411] WriteFile (in: hFile=0x228, lpBuffer=0x235c948*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x235c948*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.412] CloseHandle (hObject=0x228) returned 1 [0053.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0053.412] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0053.412] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.413] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x53 [0053.413] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x54 [0053.413] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.414] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.414] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x62 [0053.414] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x80) returned 0 [0053.418] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0053.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.418] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.418] GetFileType (hFile=0x228) returned 0x1 [0053.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.418] GetFileType (hFile=0x228) returned 0x1 [0053.418] WriteFile (in: hFile=0x228, lpBuffer=0x236a578*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x236a578*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.419] CloseHandle (hObject=0x228) returned 1 [0053.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.png", lpFilePart=0x0) returned 0x5c [0053.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.420] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.421] GetFileType (hFile=0x228) returned 0x1 [0053.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.421] GetFileType (hFile=0x228) returned 0x1 [0053.421] WriteFile (in: hFile=0x228, lpBuffer=0x236b668*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x236b668*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.422] CloseHandle (hObject=0x228) returned 1 [0053.422] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0053.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.422] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.422] GetFileType (hFile=0x228) returned 0x1 [0053.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.422] GetFileType (hFile=0x228) returned 0x1 [0053.422] WriteFile (in: hFile=0x228, lpBuffer=0x236f2b0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x236f2b0*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.423] CloseHandle (hObject=0x228) returned 1 [0053.423] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0053.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.423] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.424] GetFileType (hFile=0x228) returned 0x1 [0053.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.424] GetFileType (hFile=0x228) returned 0x1 [0053.424] WriteFile (in: hFile=0x228, lpBuffer=0x2371d30*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2371d30*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.425] CloseHandle (hObject=0x228) returned 1 [0053.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.TXT", lpFilePart=0x0) returned 0x35 [0053.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.427] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.427] GetFileType (hFile=0x228) returned 0x1 [0053.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.427] GetFileType (hFile=0x228) returned 0x1 [0053.427] WriteFile (in: hFile=0x228, lpBuffer=0x237bff8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x237bff8*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.428] CloseHandle (hObject=0x228) returned 1 [0053.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.png", lpFilePart=0x0) returned 0x35 [0053.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.428] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.430] GetFileType (hFile=0x228) returned 0x1 [0053.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.430] GetFileType (hFile=0x228) returned 0x1 [0053.430] WriteFile (in: hFile=0x228, lpBuffer=0x237d098*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x237d098*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.431] CloseHandle (hObject=0x228) returned 1 [0053.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.vbs", lpFilePart=0x0) returned 0x35 [0053.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.431] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.431] GetFileType (hFile=0x228) returned 0x1 [0053.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.431] GetFileType (hFile=0x228) returned 0x1 [0053.431] WriteFile (in: hFile=0x228, lpBuffer=0x2380bf0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2380bf0*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.432] CloseHandle (hObject=0x228) returned 1 [0053.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x61 [0053.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.432] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Device\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\device\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.433] GetFileType (hFile=0x228) returned 0x1 [0053.433] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.433] GetFileType (hFile=0x228) returned 0x1 [0053.433] WriteFile (in: hFile=0x228, lpBuffer=0x23835d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23835d0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.433] CloseHandle (hObject=0x228) returned 1 [0053.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0053.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0053.434] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.434] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2a [0053.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2b [0053.435] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.435] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0053.435] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0053.435] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.437] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.437] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.438] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x51 [0053.439] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x52 [0053.439] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.441] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.441] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x5e [0053.441] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x80) returned 0 [0053.446] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0053.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.446] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.447] GetFileType (hFile=0x228) returned 0x1 [0053.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.447] GetFileType (hFile=0x228) returned 0x1 [0053.448] WriteFile (in: hFile=0x228, lpBuffer=0x2395668*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2395668*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.448] CloseHandle (hObject=0x228) returned 1 [0053.449] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", lpFilePart=0x0) returned 0x5a [0053.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.449] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.449] GetFileType (hFile=0x228) returned 0x1 [0053.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.449] GetFileType (hFile=0x228) returned 0x1 [0053.449] WriteFile (in: hFile=0x228, lpBuffer=0x2396750*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2396750*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.450] CloseHandle (hObject=0x228) returned 1 [0053.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0053.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.450] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.451] GetFileType (hFile=0x228) returned 0x1 [0053.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.451] GetFileType (hFile=0x228) returned 0x1 [0053.451] WriteFile (in: hFile=0x228, lpBuffer=0x239a380*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x239a380*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.451] CloseHandle (hObject=0x228) returned 1 [0053.452] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0053.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.452] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.452] GetFileType (hFile=0x228) returned 0x1 [0053.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.452] GetFileType (hFile=0x228) returned 0x1 [0053.452] WriteFile (in: hFile=0x228, lpBuffer=0x239cdf0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x239cdf0*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.453] CloseHandle (hObject=0x228) returned 1 [0053.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.457] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0053.457] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0053.457] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.460] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x51 [0053.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x52 [0053.460] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.461] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.461] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.462] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5b [0053.463] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x80) returned 0 [0053.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0053.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.468] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.469] GetFileType (hFile=0x228) returned 0x1 [0053.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.469] GetFileType (hFile=0x228) returned 0x1 [0053.470] WriteFile (in: hFile=0x228, lpBuffer=0x23ac590*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23ac590*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.471] CloseHandle (hObject=0x228) returned 1 [0053.471] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", lpFilePart=0x0) returned 0x5a [0053.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.471] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.471] GetFileType (hFile=0x228) returned 0x1 [0053.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.471] GetFileType (hFile=0x228) returned 0x1 [0053.471] WriteFile (in: hFile=0x228, lpBuffer=0x23ad678*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23ad678*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.472] CloseHandle (hObject=0x228) returned 1 [0053.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0053.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.472] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.473] GetFileType (hFile=0x228) returned 0x1 [0053.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.473] GetFileType (hFile=0x228) returned 0x1 [0053.473] WriteFile (in: hFile=0x228, lpBuffer=0x23b12a8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x23b12a8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.473] CloseHandle (hObject=0x228) returned 1 [0053.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0053.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.474] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.474] GetFileType (hFile=0x228) returned 0x1 [0053.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.474] GetFileType (hFile=0x228) returned 0x1 [0053.474] WriteFile (in: hFile=0x228, lpBuffer=0x23b3d18*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23b3d18*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.475] CloseHandle (hObject=0x228) returned 1 [0053.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0053.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.477] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.477] GetFileType (hFile=0x228) returned 0x1 [0053.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.477] GetFileType (hFile=0x228) returned 0x1 [0053.478] WriteFile (in: hFile=0x228, lpBuffer=0x23bdfd0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23bdfd0*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.478] CloseHandle (hObject=0x228) returned 1 [0053.479] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.png", lpFilePart=0x0) returned 0x33 [0053.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.479] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.480] GetFileType (hFile=0x228) returned 0x1 [0053.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.480] GetFileType (hFile=0x228) returned 0x1 [0053.480] WriteFile (in: hFile=0x228, lpBuffer=0x23bf068*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23bf068*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.481] CloseHandle (hObject=0x228) returned 1 [0053.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0053.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.481] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.481] GetFileType (hFile=0x228) returned 0x1 [0053.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.482] GetFileType (hFile=0x228) returned 0x1 [0053.482] WriteFile (in: hFile=0x228, lpBuffer=0x23c2ba8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x23c2ba8*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.482] CloseHandle (hObject=0x228) returned 1 [0053.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0053.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.483] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.483] GetFileType (hFile=0x228) returned 0x1 [0053.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.483] GetFileType (hFile=0x228) returned 0x1 [0053.483] WriteFile (in: hFile=0x228, lpBuffer=0x23c5578*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23c5578*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.484] CloseHandle (hObject=0x228) returned 1 [0053.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0053.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.484] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\device stage\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.484] GetFileType (hFile=0x228) returned 0x1 [0053.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.484] GetFileType (hFile=0x228) returned 0x1 [0053.485] WriteFile (in: hFile=0x228, lpBuffer=0x23cf820*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23cf820*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.485] CloseHandle (hObject=0x228) returned 1 [0053.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.png", lpFilePart=0x0) returned 0x2e [0053.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.486] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.png" (normalized: "c:\\programdata\\microsoft\\device stage\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.486] GetFileType (hFile=0x228) returned 0x1 [0053.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.486] GetFileType (hFile=0x228) returned 0x1 [0053.486] WriteFile (in: hFile=0x228, lpBuffer=0x23d08b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23d08b0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.487] CloseHandle (hObject=0x228) returned 1 [0053.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0053.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.487] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\device stage\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.487] GetFileType (hFile=0x228) returned 0x1 [0053.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.487] GetFileType (hFile=0x228) returned 0x1 [0053.487] WriteFile (in: hFile=0x228, lpBuffer=0x23d43d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23d43d8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.488] CloseHandle (hObject=0x228) returned 1 [0053.488] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Device Stage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0053.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.488] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\device stage\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.490] GetFileType (hFile=0x228) returned 0x1 [0053.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.490] GetFileType (hFile=0x228) returned 0x1 [0053.490] WriteFile (in: hFile=0x228, lpBuffer=0x23d6d98*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23d6d98*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.491] CloseHandle (hObject=0x228) returned 1 [0053.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0053.491] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0053.491] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.492] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.492] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x23 [0053.492] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x24 [0053.492] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.493] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.493] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.493] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.493] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0053.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.493] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\devicesync\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.493] GetFileType (hFile=0x228) returned 0x1 [0053.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.493] GetFileType (hFile=0x228) returned 0x1 [0053.494] WriteFile (in: hFile=0x228, lpBuffer=0x23e2a40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23e2a40*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.495] CloseHandle (hObject=0x228) returned 1 [0053.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.png", lpFilePart=0x0) returned 0x2c [0053.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.495] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.png" (normalized: "c:\\programdata\\microsoft\\devicesync\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.495] GetFileType (hFile=0x228) returned 0x1 [0053.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.495] GetFileType (hFile=0x228) returned 0x1 [0053.495] WriteFile (in: hFile=0x228, lpBuffer=0x23e3ad0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23e3ad0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.496] CloseHandle (hObject=0x228) returned 1 [0053.496] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0053.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.496] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\devicesync\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.497] GetFileType (hFile=0x228) returned 0x1 [0053.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.497] GetFileType (hFile=0x228) returned 0x1 [0053.497] WriteFile (in: hFile=0x228, lpBuffer=0x23e75f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23e75f8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.498] CloseHandle (hObject=0x228) returned 1 [0053.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DeviceSync\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0053.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.498] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DeviceSync\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\devicesync\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.499] GetFileType (hFile=0x228) returned 0x1 [0053.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.499] GetFileType (hFile=0x228) returned 0x1 [0053.499] WriteFile (in: hFile=0x228, lpBuffer=0x23e9fb8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23e9fb8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.500] CloseHandle (hObject=0x228) returned 1 [0053.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0053.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0053.500] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.501] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM", lpFilePart=0x0) returned 0x1c [0053.501] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x1d [0053.501] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.502] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0053.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0053.502] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.502] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x23 [0053.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x24 [0053.503] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.503] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0053.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.503] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\drm\\server\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.504] GetFileType (hFile=0x228) returned 0x1 [0053.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.504] GetFileType (hFile=0x228) returned 0x1 [0053.504] WriteFile (in: hFile=0x228, lpBuffer=0x23f7778*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23f7778*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.505] CloseHandle (hObject=0x228) returned 1 [0053.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.png", lpFilePart=0x0) returned 0x2c [0053.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.505] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.png" (normalized: "c:\\programdata\\microsoft\\drm\\server\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.505] GetFileType (hFile=0x228) returned 0x1 [0053.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.506] GetFileType (hFile=0x228) returned 0x1 [0053.506] WriteFile (in: hFile=0x228, lpBuffer=0x23f8808*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23f8808*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.507] CloseHandle (hObject=0x228) returned 1 [0053.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0053.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.507] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\drm\\server\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.507] GetFileType (hFile=0x228) returned 0x1 [0053.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.507] GetFileType (hFile=0x228) returned 0x1 [0053.507] WriteFile (in: hFile=0x228, lpBuffer=0x23fc330*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x23fc330*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.508] CloseHandle (hObject=0x228) returned 1 [0053.508] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Server\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0053.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.508] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Server\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\drm\\server\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.509] GetFileType (hFile=0x228) returned 0x1 [0053.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.509] GetFileType (hFile=0x228) returned 0x1 [0053.509] WriteFile (in: hFile=0x228, lpBuffer=0x23fecf0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23fecf0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.510] CloseHandle (hObject=0x228) returned 1 [0053.510] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0053.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.510] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\drm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.510] GetFileType (hFile=0x228) returned 0x1 [0053.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.510] GetFileType (hFile=0x228) returned 0x1 [0053.510] WriteFile (in: hFile=0x228, lpBuffer=0x2408f78*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2408f78*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.511] CloseHandle (hObject=0x228) returned 1 [0053.511] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Hack.png", lpFilePart=0x0) returned 0x25 [0053.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.511] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.png" (normalized: "c:\\programdata\\microsoft\\drm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.512] GetFileType (hFile=0x228) returned 0x1 [0053.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.512] GetFileType (hFile=0x228) returned 0x1 [0053.512] WriteFile (in: hFile=0x228, lpBuffer=0x2409ff8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2409ff8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.513] CloseHandle (hObject=0x228) returned 1 [0053.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0053.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.513] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\drm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.513] GetFileType (hFile=0x228) returned 0x1 [0053.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.513] GetFileType (hFile=0x228) returned 0x1 [0053.513] WriteFile (in: hFile=0x228, lpBuffer=0x240daf0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x240daf0*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.514] CloseHandle (hObject=0x228) returned 1 [0053.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\DRM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\DRM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0053.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.514] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\DRM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\drm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.516] GetFileType (hFile=0x228) returned 0x1 [0053.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.516] GetFileType (hFile=0x228) returned 0x1 [0053.516] WriteFile (in: hFile=0x228, lpBuffer=0x2410490*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2410490*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.517] CloseHandle (hObject=0x228) returned 1 [0053.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e [0053.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f [0053.517] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.517] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.517] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.517] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.518] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome", lpFilePart=0x0) returned 0x1e [0053.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x1f [0053.518] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.518] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23 [0053.518] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24 [0053.519] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.519] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.519] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.519] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.519] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x23 [0053.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x24 [0053.520] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.520] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.520] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0053.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.520] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.520] GetFileType (hFile=0x228) returned 0x1 [0053.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.521] GetFileType (hFile=0x228) returned 0x1 [0053.521] WriteFile (in: hFile=0x228, lpBuffer=0x241dce0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x241dce0*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.522] CloseHandle (hObject=0x228) returned 1 [0053.522] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.png", lpFilePart=0x0) returned 0x2c [0053.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.png" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.523] GetFileType (hFile=0x228) returned 0x1 [0053.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.523] GetFileType (hFile=0x228) returned 0x1 [0053.523] WriteFile (in: hFile=0x228, lpBuffer=0x241ed70*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x241ed70*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.524] CloseHandle (hObject=0x228) returned 1 [0053.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0053.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.524] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.524] GetFileType (hFile=0x228) returned 0x1 [0053.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.524] GetFileType (hFile=0x228) returned 0x1 [0053.546] WriteFile (in: hFile=0x228, lpBuffer=0x2223308*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2223308*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.546] CloseHandle (hObject=0x228) returned 1 [0053.547] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0053.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.547] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\ehome\\logs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.547] GetFileType (hFile=0x228) returned 0x1 [0053.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.547] WriteFile (in: hFile=0x228, lpBuffer=0x2225cc8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2225cc8*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.551] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\Hack.TXT", lpFilePart=0x0) returned 0x27 [0053.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.551] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\ehome\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.551] WriteFile (in: hFile=0x228, lpBuffer=0x222ff50*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x222ff50*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.552] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\Hack.png", lpFilePart=0x0) returned 0x27 [0053.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.552] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.png" (normalized: "c:\\programdata\\microsoft\\ehome\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\Hack.vbs", lpFilePart=0x0) returned 0x27 [0053.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.554] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\ehome\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.555] WriteFile (in: hFile=0x228, lpBuffer=0x2234ac8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2234ac8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.555] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\eHome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\eHome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x53 [0053.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.556] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\eHome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\ehome\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.557] WriteFile (in: hFile=0x228, lpBuffer=0x2237468*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2237468*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0053.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0053.558] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.559] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x25 [0053.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x26 [0053.559] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.560] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0053.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0053.560] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.561] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.561] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2b [0053.561] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x2c [0053.561] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.562] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0053.562] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0053.562] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.562] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x44 [0053.563] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x45 [0053.563] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.563] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.565] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.TXT", lpFilePart=0x0) returned 0x4d [0053.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.565] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.566] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", lpFilePart=0x0) returned 0x4d [0053.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.566] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.567] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.vbs", lpFilePart=0x0) returned 0x4d [0053.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.567] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.568] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x79 [0053.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.568] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\applicationviewsrootnode\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.570] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.TXT", lpFilePart=0x0) returned 0x34 [0053.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.570] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.png", lpFilePart=0x0) returned 0x34 [0053.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.571] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.png" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.vbs", lpFilePart=0x0) returned 0x34 [0053.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.574] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x60 [0053.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.576] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Views\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\event viewer\\views\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.580] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0053.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.580] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\event viewer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.581] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.png", lpFilePart=0x0) returned 0x2e [0053.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.581] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.png" (normalized: "c:\\programdata\\microsoft\\event viewer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.582] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0053.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.582] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\event viewer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0053.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.584] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\event viewer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0053.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0053.586] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.586] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x24 [0053.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x25 [0053.587] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.587] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0053.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.587] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\identitycrl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.png", lpFilePart=0x0) returned 0x2d [0053.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.588] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.png" (normalized: "c:\\programdata\\microsoft\\identitycrl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.589] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0053.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.590] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\identitycrl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.592] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\IdentityCRL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0053.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.592] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\IdentityCRL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\identitycrl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25 [0053.593] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26 [0053.593] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.593] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x25 [0053.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x26 [0053.594] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.594] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.594] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0053.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.594] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\media player\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.595] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\Hack.png", lpFilePart=0x0) returned 0x2e [0053.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.595] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.png" (normalized: "c:\\programdata\\microsoft\\media player\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.596] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0053.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.596] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\media player\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.597] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0053.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.597] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\media player\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.599] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b [0053.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c [0053.600] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.600] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF", lpFilePart=0x0) returned 0x1b [0053.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x1c [0053.601] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.601] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Hack.TXT", lpFilePart=0x0) returned 0x24 [0053.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.601] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\mf\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Hack.png", lpFilePart=0x0) returned 0x24 [0053.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.602] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.png" (normalized: "c:\\programdata\\microsoft\\mf\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.604] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\Hack.vbs", lpFilePart=0x0) returned 0x24 [0053.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.604] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\mf\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.605] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MF\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MF\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x50 [0053.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.605] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\mf\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d [0053.609] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e [0053.609] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.612] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x1d [0053.612] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x1e [0053.612] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.613] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21 [0053.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22 [0053.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.614] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x21 [0053.614] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x22 [0053.614] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.614] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.TXT", lpFilePart=0x0) returned 0x2a [0053.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.614] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.615] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.png", lpFilePart=0x0) returned 0x2a [0053.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.616] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.png" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.617] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.vbs", lpFilePart=0x0) returned 0x2a [0053.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.617] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.618] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x56 [0053.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.618] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\8.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\msdn\\8.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.619] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\Hack.TXT", lpFilePart=0x0) returned 0x26 [0053.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.619] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\msdn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.620] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\Hack.png", lpFilePart=0x0) returned 0x26 [0053.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.620] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.png" (normalized: "c:\\programdata\\microsoft\\msdn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.621] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\Hack.vbs", lpFilePart=0x0) returned 0x26 [0053.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.621] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\msdn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.622] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\MSDN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x52 [0053.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.622] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MSDN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\msdn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25 [0053.624] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26 [0053.624] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.625] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.625] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.625] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.626] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x25 [0053.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x26 [0053.626] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.626] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35 [0053.626] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36 [0053.626] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.627] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.627] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x35 [0053.627] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x36 [0053.627] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.628] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.628] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.TXT", lpFilePart=0x0) returned 0x3e [0053.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.628] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.636] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", lpFilePart=0x0) returned 0x3e [0053.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.636] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.637] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.vbs", lpFilePart=0x0) returned 0x3e [0053.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.638] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.639] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6a [0053.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.639] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\BreadcrumbStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\netframework\\breadcrumbstore\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.641] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0053.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.641] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\netframework\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.642] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.png", lpFilePart=0x0) returned 0x2e [0053.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.642] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.png" (normalized: "c:\\programdata\\microsoft\\netframework\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.643] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0053.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.643] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\netframework\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.644] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\NetFramework\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0053.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.644] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\NetFramework\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\netframework\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20 [0053.646] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21 [0053.646] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.646] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.647] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network", lpFilePart=0x0) returned 0x20 [0053.647] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x21 [0053.647] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.648] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.648] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.648] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c [0053.648] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d [0053.648] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.648] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.648] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.648] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x2c [0053.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x2d [0053.649] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.649] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.649] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.649] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.649] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.TXT", lpFilePart=0x0) returned 0x35 [0053.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.649] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\network\\connections\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.650] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.png", lpFilePart=0x0) returned 0x35 [0053.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.651] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.png" (normalized: "c:\\programdata\\microsoft\\network\\connections\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.652] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.vbs", lpFilePart=0x0) returned 0x35 [0053.652] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\network\\connections\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.653] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x61 [0053.653] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\network\\connections\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b [0053.655] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c [0053.655] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.655] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.655] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.655] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.655] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.655] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2b [0053.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x2c [0053.656] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.656] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.656] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.656] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.656] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.656] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.656] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.TXT", lpFilePart=0x0) returned 0x34 [0053.656] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.657] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.png", lpFilePart=0x0) returned 0x34 [0053.657] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.png" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.658] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.vbs", lpFilePart=0x0) returned 0x34 [0053.659] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.659] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Downloader\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x60 [0053.660] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Downloader\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\network\\downloader\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.662] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Hack.TXT", lpFilePart=0x0) returned 0x29 [0053.662] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\network\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.663] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Hack.png", lpFilePart=0x0) returned 0x29 [0053.663] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.png" (normalized: "c:\\programdata\\microsoft\\network\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.664] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\Hack.vbs", lpFilePart=0x0) returned 0x29 [0053.664] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\network\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.666] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x55 [0053.666] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\network\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f [0053.667] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20 [0053.667] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.679] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.679] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.680] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.681] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x1f [0053.681] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x20 [0053.681] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.682] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.682] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a [0053.683] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b [0053.683] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.685] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2a [0053.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2b [0053.685] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.685] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.685] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f [0053.685] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30 [0053.686] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.700] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x2f [0053.700] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x30 [0053.700] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.702] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.703] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0053.703] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.705] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", lpFilePart=0x0) returned 0x38 [0053.705] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.706] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0053.706] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.709] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0053.709] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.710] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f [0053.710] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30 [0053.710] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.716] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.718] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.718] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x2f [0053.719] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x30 [0053.719] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.721] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.721] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0053.721] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.723] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", lpFilePart=0x0) returned 0x38 [0053.723] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.724] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0053.724] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.725] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0053.725] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.726] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0053.726] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.728] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.png", lpFilePart=0x0) returned 0x33 [0053.728] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.png" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.729] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0053.729] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.730] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0053.730] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.733] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.TXT", lpFilePart=0x0) returned 0x28 [0053.733] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\office\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.734] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.png", lpFilePart=0x0) returned 0x28 [0053.734] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.png" (normalized: "c:\\programdata\\microsoft\\office\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.735] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.vbs", lpFilePart=0x0) returned 0x28 [0053.735] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\office\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.736] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OFFICE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x54 [0053.736] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\office\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39 [0053.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a [0053.737] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.737] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x39 [0053.737] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3a [0053.737] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.738] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f [0053.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40 [0053.738] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.738] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x3f [0053.738] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x40 [0053.738] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.739] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.739] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.739] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.739] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0053.739] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.740] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", lpFilePart=0x0) returned 0x48 [0053.740] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.741] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0053.741] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.742] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0053.742] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\cache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.744] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.TXT", lpFilePart=0x0) returned 0x42 [0053.744] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.745] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", lpFilePart=0x0) returned 0x42 [0053.745] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.746] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.vbs", lpFilePart=0x0) returned 0x42 [0053.746] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.747] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6e [0053.747] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c [0053.755] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d [0053.755] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.755] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.756] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC", lpFilePart=0x0) returned 0x1c [0053.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x1d [0053.756] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.756] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.756] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25 [0053.756] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26 [0053.757] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.757] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.757] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.757] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x25 [0053.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x26 [0053.757] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.757] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.757] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.757] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.757] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0053.757] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.760] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.png", lpFilePart=0x0) returned 0x2e [0053.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.png" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.761] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0053.761] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.762] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0053.762] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Outbound\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\rac\\outbound\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a [0053.763] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b [0053.763] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.764] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.764] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2a [0053.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2b [0053.764] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.764] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.764] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0053.766] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.png", lpFilePart=0x0) returned 0x33 [0053.767] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0053.768] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0053.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26 [0053.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27 [0053.771] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.771] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x26 [0053.771] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x27 [0053.772] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.772] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.772] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.TXT", lpFilePart=0x0) returned 0x2f [0053.773] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.png", lpFilePart=0x0) returned 0x2f [0053.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\Hack.vbs", lpFilePart=0x0) returned 0x2f [0053.774] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\StateData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\StateData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5b [0053.775] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21 [0053.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22 [0053.776] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.776] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x21 [0053.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x22 [0053.776] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.776] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.776] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.TXT", lpFilePart=0x0) returned 0x2a [0053.777] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.png", lpFilePart=0x0) returned 0x2a [0053.778] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\Hack.vbs", lpFilePart=0x0) returned 0x2a [0053.779] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x56 [0053.788] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0053.790] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Hack.png", lpFilePart=0x0) returned 0x25 [0053.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0053.791] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\RAC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\RAC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0053.792] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f [0053.793] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20 [0053.793] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.793] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search", lpFilePart=0x0) returned 0x1f [0053.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x20 [0053.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.794] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.794] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x24 [0053.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.794] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.794] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.794] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.795] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.795] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.796] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.796] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.798] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.798] GetFileType (hFile=0x228) returned 0x1 [0053.798] GetFileType (hFile=0x228) returned 0x1 [0053.798] WriteFile (in: hFile=0x228, lpBuffer=0x222c090*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x222c090*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.799] CloseHandle (hObject=0x228) returned 1 [0053.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.799] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Hack.png" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.800] GetFileType (hFile=0x228) returned 0x1 [0053.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.800] GetFileType (hFile=0x228) returned 0x1 [0053.800] WriteFile (in: hFile=0x228, lpBuffer=0x222d138*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x222d138*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.801] CloseHandle (hObject=0x228) returned 1 [0053.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.801] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.801] GetFileType (hFile=0x228) returned 0x1 [0053.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.801] GetFileType (hFile=0x228) returned 0x1 [0053.801] WriteFile (in: hFile=0x228, lpBuffer=0x2230ca8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2230ca8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.802] CloseHandle (hObject=0x228) returned 1 [0053.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.802] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Applications\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\search\\data\\applications\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.803] GetFileType (hFile=0x228) returned 0x1 [0053.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.804] GetFileType (hFile=0x228) returned 0x1 [0053.804] WriteFile (in: hFile=0x228, lpBuffer=0x2233698*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2233698*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.804] CloseHandle (hObject=0x228) returned 1 [0053.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.805] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.805] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.805] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.805] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x29 [0053.805] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2a [0053.805] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0053.806] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0053.806] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0053.806] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0053.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0053.807] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0053.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.807] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.807] GetFileType (hFile=0x228) returned 0x1 [0053.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.807] GetFileType (hFile=0x228) returned 0x1 [0053.807] WriteFile (in: hFile=0x228, lpBuffer=0x223f460*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x223f460*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0053.808] CloseHandle (hObject=0x228) returned 1 [0053.808] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.png", lpFilePart=0x0) returned 0x32 [0053.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0053.809] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.png" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.809] GetFileType (hFile=0x228) returned 0x1 [0053.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0053.809] GetFileType (hFile=0x228) returned 0x1 [0053.809] WriteFile (in: hFile=0x228, lpBuffer=0x22404f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22404f8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.810] CloseHandle (hObject=0x228) returned 1 [0053.810] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0053.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.810] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.811] GetFileType (hFile=0x228) returned 0x1 [0053.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.811] GetFileType (hFile=0x228) returned 0x1 [0053.811] WriteFile (in: hFile=0x228, lpBuffer=0x2244038*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2244038*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0053.812] CloseHandle (hObject=0x228) returned 1 [0053.812] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0053.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0053.812] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\search\\data\\temp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.812] GetFileType (hFile=0x228) returned 0x1 [0053.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0053.812] GetFileType (hFile=0x228) returned 0x1 [0053.812] WriteFile (in: hFile=0x228, lpBuffer=0x2246a08*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2246a08*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0053.813] CloseHandle (hObject=0x228) returned 1 [0053.813] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0053.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.813] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\search\\data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.814] GetFileType (hFile=0x228) returned 0x1 [0053.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.814] GetFileType (hFile=0x228) returned 0x1 [0053.814] WriteFile (in: hFile=0x228, lpBuffer=0x2250cb0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2250cb0*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.815] CloseHandle (hObject=0x228) returned 1 [0053.815] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.png", lpFilePart=0x0) returned 0x2d [0053.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.815] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.png" (normalized: "c:\\programdata\\microsoft\\search\\data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.815] GetFileType (hFile=0x228) returned 0x1 [0053.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.815] GetFileType (hFile=0x228) returned 0x1 [0053.815] WriteFile (in: hFile=0x228, lpBuffer=0x2251d40*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2251d40*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.816] CloseHandle (hObject=0x228) returned 1 [0053.816] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0053.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.816] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\search\\data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.816] GetFileType (hFile=0x228) returned 0x1 [0053.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.817] GetFileType (hFile=0x228) returned 0x1 [0053.817] WriteFile (in: hFile=0x228, lpBuffer=0x2255868*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2255868*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.817] CloseHandle (hObject=0x228) returned 1 [0053.817] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0053.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.818] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\search\\data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.819] GetFileType (hFile=0x228) returned 0x1 [0053.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.819] GetFileType (hFile=0x228) returned 0x1 [0053.819] WriteFile (in: hFile=0x228, lpBuffer=0x2258228*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2258228*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.820] CloseHandle (hObject=0x228) returned 1 [0053.821] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Hack.TXT", lpFilePart=0x0) returned 0x28 [0053.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.821] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\search\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.821] GetFileType (hFile=0x228) returned 0x1 [0053.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.821] GetFileType (hFile=0x228) returned 0x1 [0053.822] WriteFile (in: hFile=0x228, lpBuffer=0x22624c0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22624c0*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.822] CloseHandle (hObject=0x228) returned 1 [0053.823] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Hack.png", lpFilePart=0x0) returned 0x28 [0053.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.823] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.png" (normalized: "c:\\programdata\\microsoft\\search\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.823] GetFileType (hFile=0x228) returned 0x1 [0053.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.823] GetFileType (hFile=0x228) returned 0x1 [0053.823] WriteFile (in: hFile=0x228, lpBuffer=0x2263548*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2263548*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.824] CloseHandle (hObject=0x228) returned 1 [0053.824] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\Hack.vbs", lpFilePart=0x0) returned 0x28 [0053.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.824] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\search\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.825] GetFileType (hFile=0x228) returned 0x1 [0053.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.825] GetFileType (hFile=0x228) returned 0x1 [0053.825] WriteFile (in: hFile=0x228, lpBuffer=0x2267058*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2267058*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.825] CloseHandle (hObject=0x228) returned 1 [0053.826] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x54 [0053.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.826] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\search\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.827] GetFileType (hFile=0x228) returned 0x1 [0053.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.827] GetFileType (hFile=0x228) returned 0x1 [0053.827] WriteFile (in: hFile=0x228, lpBuffer=0x2269a08*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2269a08*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.828] CloseHandle (hObject=0x228) returned 1 [0053.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e [0053.828] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x2f [0053.828] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.828] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.829] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.829] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.829] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x2e [0053.829] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x2f [0053.829] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.829] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.830] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.830] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.830] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x3f [0053.830] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x40 [0053.830] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.847] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.847] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.848] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.851] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.851] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.851] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.851] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.851] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.851] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x3f [0053.852] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x40 [0053.852] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.854] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.855] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.856] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.856] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.856] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.856] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.857] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0053.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.857] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.858] GetFileType (hFile=0x228) returned 0x1 [0053.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.858] GetFileType (hFile=0x228) returned 0x1 [0053.858] WriteFile (in: hFile=0x228, lpBuffer=0x2281d58*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2281d58*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0053.859] CloseHandle (hObject=0x228) returned 1 [0053.859] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", lpFilePart=0x0) returned 0x48 [0053.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0053.859] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.860] GetFileType (hFile=0x228) returned 0x1 [0053.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0053.860] GetFileType (hFile=0x228) returned 0x1 [0053.860] WriteFile (in: hFile=0x228, lpBuffer=0x2282e20*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2282e20*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0053.861] CloseHandle (hObject=0x228) returned 1 [0053.861] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0053.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.861] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.861] GetFileType (hFile=0x228) returned 0x1 [0053.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.861] GetFileType (hFile=0x228) returned 0x1 [0053.861] WriteFile (in: hFile=0x228, lpBuffer=0x22869f0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x22869f0*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0053.862] CloseHandle (hObject=0x228) returned 1 [0053.862] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0053.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.862] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Default Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\user account pictures\\default pictures\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.863] GetFileType (hFile=0x228) returned 0x1 [0053.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0053.863] GetFileType (hFile=0x228) returned 0x1 [0053.863] WriteFile (in: hFile=0x228, lpBuffer=0x2289420*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2289420*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0053.864] CloseHandle (hObject=0x228) returned 1 [0053.865] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0053.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.865] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\user account pictures\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.865] GetFileType (hFile=0x228) returned 0x1 [0053.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.867] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.png", lpFilePart=0x0) returned 0x37 [0053.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.867] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.png" (normalized: "c:\\programdata\\microsoft\\user account pictures\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.868] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0053.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.868] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\user account pictures\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.869] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\User Account Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0053.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.870] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\User Account Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\user account pictures\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e [0053.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f [0053.871] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.871] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault", lpFilePart=0x0) returned 0x1e [0053.871] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x1f [0053.871] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.872] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.872] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.872] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.872] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\Hack.TXT", lpFilePart=0x0) returned 0x27 [0053.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.872] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\vault\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.874] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\Hack.png", lpFilePart=0x0) returned 0x27 [0053.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.874] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.png" (normalized: "c:\\programdata\\microsoft\\vault\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.875] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\Hack.vbs", lpFilePart=0x0) returned 0x27 [0053.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.875] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\vault\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.876] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Vault\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Vault\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x53 [0053.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.876] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Vault\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\vault\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e [0053.877] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f [0053.877] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.879] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.879] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x1e [0053.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x1f [0053.879] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.879] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.879] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.879] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.879] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\Hack.TXT", lpFilePart=0x0) returned 0x27 [0053.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.879] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\visio\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.880] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\Hack.png", lpFilePart=0x0) returned 0x27 [0053.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.881] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.png" (normalized: "c:\\programdata\\microsoft\\visio\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.882] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\Hack.vbs", lpFilePart=0x0) returned 0x27 [0053.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.882] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\visio\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.883] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\VISIO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x53 [0053.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.883] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\VISIO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\visio\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20 [0053.889] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21 [0053.889] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.890] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x20 [0053.890] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x21 [0053.890] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.890] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29 [0053.891] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a [0053.891] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.891] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.891] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.891] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x29 [0053.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2a [0053.892] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0053.892] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0053.892] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0053.892] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0053.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0053.892] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0053.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0053.892] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Profiles\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\wwansvc\\profiles\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0053.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ea690) returned 1 [0053.907] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.TXT", lpFilePart=0x0) returned 0x29 [0053.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.907] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\wwansvc\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.908] GetFileType (hFile=0x228) returned 0x1 [0053.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.908] GetFileType (hFile=0x228) returned 0x1 [0053.908] WriteFile (in: hFile=0x228, lpBuffer=0x22d6580*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22d6580*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.909] CloseHandle (hObject=0x228) returned 1 [0053.909] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.png", lpFilePart=0x0) returned 0x29 [0053.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.909] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.png" (normalized: "c:\\programdata\\microsoft\\wwansvc\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.910] GetFileType (hFile=0x228) returned 0x1 [0053.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.910] GetFileType (hFile=0x228) returned 0x1 [0053.910] WriteFile (in: hFile=0x228, lpBuffer=0x22d7608*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22d7608*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.910] CloseHandle (hObject=0x228) returned 1 [0053.911] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.vbs", lpFilePart=0x0) returned 0x29 [0053.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.911] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\wwansvc\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.911] GetFileType (hFile=0x228) returned 0x1 [0053.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.911] GetFileType (hFile=0x228) returned 0x1 [0053.911] WriteFile (in: hFile=0x228, lpBuffer=0x22db118*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22db118*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.912] CloseHandle (hObject=0x228) returned 1 [0053.912] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\WwanSvc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x55 [0053.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.912] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\WwanSvc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\wwansvc\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.914] GetFileType (hFile=0x228) returned 0x1 [0053.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.914] GetFileType (hFile=0x228) returned 0x1 [0053.914] WriteFile (in: hFile=0x228, lpBuffer=0x22ddac8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22ddac8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.915] CloseHandle (hObject=0x228) returned 1 [0053.917] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Hack.TXT", lpFilePart=0x0) returned 0x21 [0053.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.917] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Hack.TXT" (normalized: "c:\\programdata\\microsoft\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.917] GetFileType (hFile=0x228) returned 0x1 [0053.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.917] GetFileType (hFile=0x228) returned 0x1 [0053.917] WriteFile (in: hFile=0x228, lpBuffer=0x22e7d40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22e7d40*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.918] CloseHandle (hObject=0x228) returned 1 [0053.918] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x21 [0053.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.918] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Hack.png" (normalized: "c:\\programdata\\microsoft\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.919] GetFileType (hFile=0x228) returned 0x1 [0053.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.919] GetFileType (hFile=0x228) returned 0x1 [0053.919] WriteFile (in: hFile=0x228, lpBuffer=0x22e8db8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x22e8db8*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.920] CloseHandle (hObject=0x228) returned 1 [0053.920] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\Hack.vbs", lpFilePart=0x0) returned 0x21 [0053.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.920] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Hack.vbs" (normalized: "c:\\programdata\\microsoft\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.920] GetFileType (hFile=0x228) returned 0x1 [0053.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.920] GetFileType (hFile=0x228) returned 0x1 [0053.920] WriteFile (in: hFile=0x228, lpBuffer=0x22ec898*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x22ec898*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.921] CloseHandle (hObject=0x228) returned 1 [0053.921] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4d [0053.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.921] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.934] GetFileType (hFile=0x228) returned 0x1 [0053.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.934] GetFileType (hFile=0x228) returned 0x1 [0053.934] WriteFile (in: hFile=0x228, lpBuffer=0x22ef228*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22ef228*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.935] CloseHandle (hObject=0x228) returned 1 [0053.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.936] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d [0053.936] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e [0053.936] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.954] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help", lpFilePart=0x0) returned 0x1d [0053.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\", lpFilePart=0x0) returned 0x1e [0053.955] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.960] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\Hack.TXT", lpFilePart=0x0) returned 0x26 [0053.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.961] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.TXT" (normalized: "c:\\programdata\\microsoft help\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.963] GetFileType (hFile=0x228) returned 0x1 [0053.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.963] GetFileType (hFile=0x228) returned 0x1 [0053.964] WriteFile (in: hFile=0x228, lpBuffer=0x2302440*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2302440*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.965] CloseHandle (hObject=0x228) returned 1 [0053.965] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\Hack.png", lpFilePart=0x0) returned 0x26 [0053.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.965] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.png" (normalized: "c:\\programdata\\microsoft help\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.966] GetFileType (hFile=0x228) returned 0x1 [0053.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.966] GetFileType (hFile=0x228) returned 0x1 [0053.966] WriteFile (in: hFile=0x228, lpBuffer=0x23034c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x23034c0*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.967] CloseHandle (hObject=0x228) returned 1 [0053.967] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\Hack.vbs", lpFilePart=0x0) returned 0x26 [0053.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.967] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\Hack.vbs" (normalized: "c:\\programdata\\microsoft help\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.968] GetFileType (hFile=0x228) returned 0x1 [0053.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.968] GetFileType (hFile=0x228) returned 0x1 [0053.968] WriteFile (in: hFile=0x228, lpBuffer=0x2306fb8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x2306fb8*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.969] CloseHandle (hObject=0x228) returned 1 [0053.969] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x52 [0053.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.969] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\microsoft help\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.970] GetFileType (hFile=0x228) returned 0x1 [0053.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.970] GetFileType (hFile=0x228) returned 0x1 [0053.970] WriteFile (in: hFile=0x228, lpBuffer=0x2309958*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2309958*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.971] CloseHandle (hObject=0x228) returned 1 [0053.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16 [0053.971] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17 [0053.971] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.972] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla", lpFilePart=0x0) returned 0x16 [0053.972] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\", lpFilePart=0x0) returned 0x17 [0053.973] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.973] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.973] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.973] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.973] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b [0053.973] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c [0053.974] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.975] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0053.975] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs", lpFilePart=0x0) returned 0x1b [0053.976] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x1c [0053.976] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0053.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0053.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0053.976] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0053.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0053.977] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\Hack.TXT", lpFilePart=0x0) returned 0x24 [0053.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.977] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.TXT" (normalized: "c:\\programdata\\mozilla\\logs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.977] GetFileType (hFile=0x228) returned 0x1 [0053.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.977] GetFileType (hFile=0x228) returned 0x1 [0053.978] WriteFile (in: hFile=0x228, lpBuffer=0x23172c0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23172c0*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0053.979] CloseHandle (hObject=0x228) returned 1 [0053.979] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\Hack.png", lpFilePart=0x0) returned 0x24 [0053.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0053.979] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.png" (normalized: "c:\\programdata\\mozilla\\logs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.980] GetFileType (hFile=0x228) returned 0x1 [0053.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0053.980] GetFileType (hFile=0x228) returned 0x1 [0053.980] WriteFile (in: hFile=0x228, lpBuffer=0x2318340*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2318340*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0053.981] CloseHandle (hObject=0x228) returned 1 [0053.982] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\Hack.vbs", lpFilePart=0x0) returned 0x24 [0053.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.982] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\Hack.vbs" (normalized: "c:\\programdata\\mozilla\\logs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.982] GetFileType (hFile=0x228) returned 0x1 [0053.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.982] GetFileType (hFile=0x228) returned 0x1 [0053.982] WriteFile (in: hFile=0x228, lpBuffer=0x231be38*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x231be38*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0053.983] CloseHandle (hObject=0x228) returned 1 [0053.983] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x50 [0053.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0053.983] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\mozilla\\logs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.985] GetFileType (hFile=0x228) returned 0x1 [0053.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0053.985] GetFileType (hFile=0x228) returned 0x1 [0053.985] WriteFile (in: hFile=0x228, lpBuffer=0x231e7d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x231e7d8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0053.985] CloseHandle (hObject=0x228) returned 1 [0053.986] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\Hack.TXT", lpFilePart=0x0) returned 0x1f [0053.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.986] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\Hack.TXT" (normalized: "c:\\programdata\\mozilla\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.986] GetFileType (hFile=0x228) returned 0x1 [0053.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.986] GetFileType (hFile=0x228) returned 0x1 [0053.986] WriteFile (in: hFile=0x228, lpBuffer=0x2328a40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2328a40*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0053.987] CloseHandle (hObject=0x228) returned 1 [0053.987] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x1f [0053.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.987] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\Hack.png" (normalized: "c:\\programdata\\mozilla\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0053.988] GetFileType (hFile=0x228) returned 0x1 [0053.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0053.988] GetFileType (hFile=0x228) returned 0x1 [0053.988] WriteFile (in: hFile=0x228, lpBuffer=0x2329ab0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2329ab0*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0053.989] CloseHandle (hObject=0x228) returned 1 [0053.989] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\Hack.vbs", lpFilePart=0x0) returned 0x1f [0053.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.989] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\Hack.vbs" (normalized: "c:\\programdata\\mozilla\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.989] GetFileType (hFile=0x228) returned 0x1 [0053.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.989] GetFileType (hFile=0x228) returned 0x1 [0053.989] WriteFile (in: hFile=0x228, lpBuffer=0x232d578*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x232d578*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0053.990] CloseHandle (hObject=0x228) returned 1 [0053.990] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4b [0053.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.990] CreateFileW (lpFileName="C:\\ProgramData\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\mozilla\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.992] GetFileType (hFile=0x228) returned 0x1 [0053.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.992] GetFileType (hFile=0x228) returned 0x1 [0053.992] WriteFile (in: hFile=0x228, lpBuffer=0x232fef8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x232fef8*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0053.993] CloseHandle (hObject=0x228) returned 1 [0053.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15 [0053.993] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\", lpFilePart=0x0) returned 0x16 [0053.994] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.994] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0053.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle", lpFilePart=0x0) returned 0x15 [0053.995] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\", lpFilePart=0x0) returned 0x16 [0053.995] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Oracle\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0053.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0053.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0053.995] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0053.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0053.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0053.996] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Hack.TXT", lpFilePart=0x0) returned 0x1e [0053.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0053.996] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Hack.TXT" (normalized: "c:\\programdata\\oracle\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0053.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0053.999] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Hack.png", lpFilePart=0x0) returned 0x1e [0053.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0053.999] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Hack.png" (normalized: "c:\\programdata\\oracle\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0054.001] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\Hack.vbs", lpFilePart=0x0) returned 0x1e [0054.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.001] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\Hack.vbs" (normalized: "c:\\programdata\\oracle\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.002] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Oracle\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Oracle\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4a [0054.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.002] CreateFileW (lpFileName="C:\\ProgramData\\Oracle\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\oracle\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0054.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c [0054.004] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\", lpFilePart=0x0) returned 0x1d [0054.004] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0054.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.036] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0054.038] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0054.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0054.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0054.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache", lpFilePart=0x0) returned 0x1c [0054.039] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\", lpFilePart=0x0) returned 0x1d [0054.039] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.040] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0054.041] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0054.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0054.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x45 [0054.042] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x46 [0054.042] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.043] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.043] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.043] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.043] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.043] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x45 [0054.043] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x46 [0054.043] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.044] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x4e [0054.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x4f [0054.044] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.044] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x4e [0054.044] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x4f [0054.045] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.045] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0054.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0054.045] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.045] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.045] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0054.046] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0054.046] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.046] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.046] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.046] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.046] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.046] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58 [0054.046] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59 [0054.046] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0054.047] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.047] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.047] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0054.047] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0054.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0054.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.048] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58 [0054.048] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59 [0054.048] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0054.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0054.048] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0054.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0054.048] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0054.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0054.048] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0054.049] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x61 [0054.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0054.050] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0054.074] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0054.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0054.074] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0054.075] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0054.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0054.076] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0054.107] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0054.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.108] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.109] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x5d [0054.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0054.109] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0054.110] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0054.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.110] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.111] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0054.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.111] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.269] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x57 [0054.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.269] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.270] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", lpFilePart=0x0) returned 0x57 [0054.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.271] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.272] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x57 [0054.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.272] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.273] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x83 [0054.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.273] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.290] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.TXT", lpFilePart=0x0) returned 0x4e [0054.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.290] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.291] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", lpFilePart=0x0) returned 0x4e [0054.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.292] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.293] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.vbs", lpFilePart=0x0) returned 0x4e [0054.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.293] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.294] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7a [0054.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.294] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x45 [0054.317] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x46 [0054.317] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.318] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.318] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x45 [0054.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x46 [0054.319] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.319] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x4e [0054.319] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x4f [0054.319] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.319] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x4e [0054.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x4f [0054.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.320] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0054.320] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0054.320] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.321] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x54 [0054.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x55 [0054.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.322] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58 [0054.322] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59 [0054.322] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0054.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0054.323] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0054.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0054.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x58 [0054.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x59 [0054.323] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0054.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0054.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0054.323] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0054.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0054.323] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0054.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0054.323] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0054.324] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x61 [0054.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0054.324] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0054.326] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0054.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0054.326] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0054.327] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0054.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0054.327] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0054.335] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0054.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.335] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.336] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x5d [0054.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0054.336] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0054.337] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0054.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.337] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.338] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0054.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.338] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.349] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x57 [0054.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.349] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.350] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", lpFilePart=0x0) returned 0x57 [0054.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.350] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.351] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x57 [0054.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.351] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.352] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x83 [0054.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.352] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.363] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.TXT", lpFilePart=0x0) returned 0x4e [0054.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.363] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.365] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", lpFilePart=0x0) returned 0x4e [0054.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.365] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.366] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.vbs", lpFilePart=0x0) returned 0x4e [0054.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.366] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.367] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7a [0054.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.367] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e [0054.373] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0054.373] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.374] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x4e [0054.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0054.374] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.374] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0054.374] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58 [0054.375] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.376] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.376] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.376] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.376] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0054.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x58 [0054.376] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.376] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.376] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.376] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.376] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c [0054.376] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d [0054.376] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.377] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6c [0054.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6d [0054.379] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.379] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.379] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", lpFilePart=0x0) returned 0x75 [0054.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.380] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.381] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x75 [0054.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0054.381] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0054.384] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", lpFilePart=0x0) returned 0x75 [0054.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.384] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.385] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa1 [0054.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.385] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.386] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0054.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.386] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.388] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x60 [0054.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.388] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.389] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0054.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.389] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.390] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0054.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.390] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.393] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.TXT", lpFilePart=0x0) returned 0x57 [0054.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.393] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.401] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x57 [0054.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.401] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.402] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.vbs", lpFilePart=0x0) returned 0x57 [0054.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.402] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.403] WriteFile (in: hFile=0x228, lpBuffer=0x2228850*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2228850*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0054.404] CloseHandle (hObject=0x228) returned 1 [0054.404] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x83 [0054.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.404] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.414] GetFileType (hFile=0x228) returned 0x1 [0054.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.414] GetFileType (hFile=0x228) returned 0x1 [0054.414] WriteFile (in: hFile=0x228, lpBuffer=0x222b2b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x222b2b0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0054.415] CloseHandle (hObject=0x228) returned 1 [0054.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43 [0054.415] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x44 [0054.415] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.416] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x43 [0054.417] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x44 [0054.417] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.417] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.419] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0054.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.420] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.420] GetFileType (hFile=0x228) returned 0x1 [0054.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.420] GetFileType (hFile=0x228) returned 0x1 [0054.420] WriteFile (in: hFile=0x228, lpBuffer=0x2237fb8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2237fb8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0054.421] CloseHandle (hObject=0x228) returned 1 [0054.421] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", lpFilePart=0x0) returned 0x4c [0054.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.421] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.425] GetFileType (hFile=0x228) returned 0x1 [0054.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.425] GetFileType (hFile=0x228) returned 0x1 [0054.425] WriteFile (in: hFile=0x228, lpBuffer=0x2239088*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2239088*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0054.426] CloseHandle (hObject=0x228) returned 1 [0054.427] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0054.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.427] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.427] GetFileType (hFile=0x228) returned 0x1 [0054.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.427] GetFileType (hFile=0x228) returned 0x1 [0054.427] WriteFile (in: hFile=0x228, lpBuffer=0x223cc70*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x223cc70*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0054.428] CloseHandle (hObject=0x228) returned 1 [0054.428] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0054.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.428] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.428] GetFileType (hFile=0x228) returned 0x1 [0054.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.428] GetFileType (hFile=0x228) returned 0x1 [0054.429] WriteFile (in: hFile=0x228, lpBuffer=0x223f6b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x223f6b0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0054.429] CloseHandle (hObject=0x228) returned 1 [0054.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.429] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x4e [0054.430] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x4f [0054.430] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.431] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.431] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.431] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.431] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x4e [0054.431] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x4f [0054.431] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.431] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.432] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.432] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.432] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57 [0054.432] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58 [0054.432] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.432] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.432] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.432] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.433] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x57 [0054.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x58 [0054.433] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.433] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.433] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.433] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.433] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.433] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71 [0054.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x72 [0054.434] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.434] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x71 [0054.434] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x72 [0054.435] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.435] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.435] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.436] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7a [0054.437] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.437] GetFileType (hFile=0x228) returned 0x1 [0054.437] GetFileType (hFile=0x228) returned 0x1 [0054.437] WriteFile (in: hFile=0x228, lpBuffer=0x22522d0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x22522d0*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0054.438] CloseHandle (hObject=0x228) returned 1 [0054.438] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7a [0054.438] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.449] GetFileType (hFile=0x228) returned 0x1 [0054.449] GetFileType (hFile=0x228) returned 0x1 [0054.449] WriteFile (in: hFile=0x228, lpBuffer=0x22533f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22533f8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0054.450] CloseHandle (hObject=0x228) returned 1 [0054.450] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7a [0054.450] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.450] GetFileType (hFile=0x228) returned 0x1 [0054.450] GetFileType (hFile=0x228) returned 0x1 [0054.450] WriteFile (in: hFile=0x228, lpBuffer=0x22570e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x22570e8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0054.451] CloseHandle (hObject=0x228) returned 1 [0054.451] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa6 [0054.452] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.452] GetFileType (hFile=0x228) returned 0x1 [0054.452] GetFileType (hFile=0x228) returned 0x1 [0054.452] WriteFile (in: hFile=0x228, lpBuffer=0x2259bd8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2259bd8*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0054.453] CloseHandle (hObject=0x228) returned 1 [0054.453] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0054.453] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.453] GetFileType (hFile=0x228) returned 0x1 [0054.453] GetFileType (hFile=0x228) returned 0x1 [0054.454] WriteFile (in: hFile=0x228, lpBuffer=0x2263f50*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2263f50*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0054.454] CloseHandle (hObject=0x228) returned 1 [0054.455] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x60 [0054.455] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.455] GetFileType (hFile=0x228) returned 0x1 [0054.455] GetFileType (hFile=0x228) returned 0x1 [0054.455] WriteFile (in: hFile=0x228, lpBuffer=0x2265048*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2265048*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0054.456] CloseHandle (hObject=0x228) returned 1 [0054.456] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0054.456] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.456] GetFileType (hFile=0x228) returned 0x1 [0054.457] GetFileType (hFile=0x228) returned 0x1 [0054.457] WriteFile (in: hFile=0x228, lpBuffer=0x2268ca8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2268ca8*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0054.457] CloseHandle (hObject=0x228) returned 1 [0054.458] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0054.458] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.460] GetFileType (hFile=0x228) returned 0x1 [0054.461] GetFileType (hFile=0x228) returned 0x1 [0054.461] WriteFile (in: hFile=0x228, lpBuffer=0x226b738*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x226b738*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0054.462] CloseHandle (hObject=0x228) returned 1 [0054.462] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.TXT", lpFilePart=0x0) returned 0x57 [0054.462] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.462] GetFileType (hFile=0x228) returned 0x1 [0054.462] GetFileType (hFile=0x228) returned 0x1 [0054.463] WriteFile (in: hFile=0x228, lpBuffer=0x2275a80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2275a80*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0054.464] CloseHandle (hObject=0x228) returned 1 [0054.464] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x57 [0054.464] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.464] GetFileType (hFile=0x228) returned 0x1 [0054.464] GetFileType (hFile=0x228) returned 0x1 [0054.464] WriteFile (in: hFile=0x228, lpBuffer=0x2276b60*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2276b60*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0054.465] CloseHandle (hObject=0x228) returned 1 [0054.465] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.vbs", lpFilePart=0x0) returned 0x57 [0054.465] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.466] GetFileType (hFile=0x228) returned 0x1 [0054.466] GetFileType (hFile=0x228) returned 0x1 [0054.466] WriteFile (in: hFile=0x228, lpBuffer=0x227a778*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x227a778*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0054.466] CloseHandle (hObject=0x228) returned 1 [0054.467] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x83 [0054.467] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.471] GetFileType (hFile=0x228) returned 0x1 [0054.471] GetFileType (hFile=0x228) returned 0x1 [0054.472] WriteFile (in: hFile=0x228, lpBuffer=0x227d1d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x227d1d8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0054.472] CloseHandle (hObject=0x228) returned 1 [0054.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x43 [0054.473] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x44 [0054.473] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.474] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x43 [0054.474] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x44 [0054.474] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.475] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.475] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0054.475] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.475] GetFileType (hFile=0x228) returned 0x1 [0054.475] GetFileType (hFile=0x228) returned 0x1 [0054.476] WriteFile (in: hFile=0x228, lpBuffer=0x2289ee0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2289ee0*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0054.477] CloseHandle (hObject=0x228) returned 1 [0054.477] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", lpFilePart=0x0) returned 0x4c [0054.477] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.478] GetFileType (hFile=0x228) returned 0x1 [0054.478] GetFileType (hFile=0x228) returned 0x1 [0054.478] WriteFile (in: hFile=0x228, lpBuffer=0x228afb0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x228afb0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0054.479] CloseHandle (hObject=0x228) returned 1 [0054.480] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0054.480] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.480] GetFileType (hFile=0x228) returned 0x1 [0054.480] GetFileType (hFile=0x228) returned 0x1 [0054.480] WriteFile (in: hFile=0x228, lpBuffer=0x228eb98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x228eb98*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0054.481] CloseHandle (hObject=0x228) returned 1 [0054.481] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0054.481] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.481] GetFileType (hFile=0x228) returned 0x1 [0054.481] GetFileType (hFile=0x228) returned 0x1 [0054.481] WriteFile (in: hFile=0x228, lpBuffer=0x22915d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22915d8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0054.482] CloseHandle (hObject=0x228) returned 1 [0054.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f [0054.482] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0054.482] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.483] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.483] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.483] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.483] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x4f [0054.483] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0054.483] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.483] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.484] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.484] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.484] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0054.484] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0054.484] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.485] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0054.485] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0054.485] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.486] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d [0054.486] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6e [0054.486] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.486] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x6d [0054.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x6e [0054.487] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.487] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.487] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", lpFilePart=0x0) returned 0x76 [0054.488] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.490] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x76 [0054.490] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", lpFilePart=0x0) returned 0x76 [0054.502] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.503] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa2 [0054.503] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.504] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0054.504] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.505] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x61 [0054.505] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.506] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0054.506] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.507] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0054.507] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.514] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x58 [0054.514] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x58 [0054.515] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.516] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x58 [0054.516] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x84 [0054.517] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f [0054.524] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0054.524] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.534] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.535] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.535] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.535] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x4f [0054.535] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0054.535] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.535] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.536] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.536] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.536] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0054.536] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0054.536] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.537] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0054.537] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0054.537] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.537] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70 [0054.538] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x71 [0054.538] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.538] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.539] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.539] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.539] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.539] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x70 [0054.539] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x71 [0054.539] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.539] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.539] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.540] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.540] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.540] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.540] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.TXT", lpFilePart=0x0) returned 0x79 [0054.540] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.541] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0054.541] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.545] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.vbs", lpFilePart=0x0) returned 0x79 [0054.545] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.546] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa5 [0054.546] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.547] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0054.547] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.548] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x61 [0054.548] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.549] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0054.549] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0054.550] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.557] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x58 [0054.557] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.558] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x58 [0054.558] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.559] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x58 [0054.559] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.560] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x84 [0054.560] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x4f [0054.571] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0054.571] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.572] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.572] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.572] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.572] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.572] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x4f [0054.572] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x50 [0054.572] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.572] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.572] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.573] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.573] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0054.573] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0054.573] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.573] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.573] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.573] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.573] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x58 [0054.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x59 [0054.574] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.574] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.574] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.574] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.574] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6f [0054.574] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x70 [0054.574] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.575] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.575] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x6f [0054.575] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x70 [0054.575] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.575] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.576] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.576] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x78 [0054.576] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.577] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x78 [0054.577] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.583] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x78 [0054.583] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.584] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa4 [0054.584] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.585] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0054.585] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.586] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x61 [0054.586] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.587] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0054.587] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.588] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0054.588] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.600] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x58 [0054.600] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.601] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x58 [0054.601] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.602] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x58 [0054.602] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.603] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x84 [0054.603] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x4e [0054.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0054.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.613] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x4e [0054.613] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x4f [0054.613] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.613] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.614] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x57 [0054.614] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.614] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.614] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.615] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.615] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.615] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.615] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.616] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.625] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.625] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.626] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.627] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.628] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.629] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.636] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.637] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.638] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.639] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.651] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.651] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.651] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.652] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.653] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.653] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.653] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.653] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.654] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.663] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.664] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.665] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.666] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.667] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.668] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.674] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.674] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.676] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.677] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.688] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.696] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.697] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.697] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.697] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.697] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.698] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.698] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.698] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.698] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.699] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.699] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.700] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.700] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.700] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.700] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.701] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.715] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.716] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.717] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.718] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.719] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.720] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.725] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.726] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.727] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.728] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.730] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.731] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.731] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.731] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.731] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.731] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.731] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.731] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.731] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.731] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.732] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.732] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.732] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.732] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.732] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.732] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.732] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.732] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.732] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.733] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.733] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.733] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.733] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.733] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.733] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.734] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.734] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.734] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.734] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.734] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.734] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.734] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.735] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.746] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.747] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.750] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.751] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.752] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.754] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.765] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.766] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.767] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.768] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.771] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.772] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.772] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.772] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.772] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.773] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.786] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.787] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.788] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.796] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.796] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.796] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.796] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.797] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.797] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.797] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.797] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.798] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.798] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.798] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.799] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0054.800] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0054.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.813] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.814] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.815] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.817] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.818] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.819] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.828] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.829] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.830] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.832] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.839] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.839] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.839] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.840] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.840] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.840] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.840] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.841] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.841] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.842] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.842] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.842] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0054.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0054.843] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.843] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0054.844] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0054.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.852] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.853] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.854] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.856] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.857] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.858] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.865] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.866] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.867] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.868] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.874] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.875] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.875] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.875] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.876] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.877] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.885] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.886] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.887] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.888] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.888] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.888] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.889] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.890] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.900] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.901] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.902] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.903] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.903] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.903] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.903] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.904] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.TXT" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.905] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.911] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.vbs" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.912] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.913] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.914] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.914] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.914] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.914] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.915] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.915] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.915] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.915] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.915] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0054.915] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0054.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0054.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0054.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0054.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0054.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0054.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0054.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0054.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0054.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0054.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0054.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0054.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0054.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0054.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0054.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0054.941] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Start Menu\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0xffffffffffffffff [0054.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf40) returned 1 [0054.944] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\Hack.TXT", lpFilePart=0x0) returned 0x22 [0054.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.945] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Hack.TXT" (normalized: "c:\\programdata\\start menu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.946] GetFileType (hFile=0x228) returned 0x1 [0054.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.946] GetFileType (hFile=0x228) returned 0x1 [0054.946] WriteFile (in: hFile=0x228, lpBuffer=0x2367e60*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2367e60*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0054.947] CloseHandle (hObject=0x228) returned 1 [0054.948] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\Hack.png", lpFilePart=0x0) returned 0x22 [0054.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.948] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Hack.png" (normalized: "c:\\programdata\\start menu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.948] GetFileType (hFile=0x228) returned 0x1 [0054.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0054.948] GetFileType (hFile=0x228) returned 0x1 [0054.949] WriteFile (in: hFile=0x228, lpBuffer=0x2368ed8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x2368ed8*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0054.949] CloseHandle (hObject=0x228) returned 1 [0054.950] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\Hack.vbs", lpFilePart=0x0) returned 0x22 [0054.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.950] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\Hack.vbs" (normalized: "c:\\programdata\\start menu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.950] GetFileType (hFile=0x228) returned 0x1 [0054.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.950] GetFileType (hFile=0x228) returned 0x1 [0054.951] WriteFile (in: hFile=0x228, lpBuffer=0x236c9b8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x236c9b8*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0054.951] CloseHandle (hObject=0x228) returned 1 [0054.952] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Start Menu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Start Menu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4e [0054.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0054.952] CreateFileW (lpFileName="C:\\ProgramData\\Start Menu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\start menu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0054.952] GetFileType (hFile=0x228) returned 0x1 [0054.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0054.952] GetFileType (hFile=0x228) returned 0x1 [0054.952] WriteFile (in: hFile=0x228, lpBuffer=0x236f348*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x236f348*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0054.953] CloseHandle (hObject=0x228) returned 1 [0054.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0054.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0054.954] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13 [0054.954] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0054.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0054.955] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0054.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0054.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0054.955] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun", lpFilePart=0x0) returned 0x12 [0054.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\", lpFilePart=0x0) returned 0x13 [0054.956] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0054.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0054.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0054.956] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0054.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0054.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17 [0054.956] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18 [0054.956] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.957] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0054.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java", lpFilePart=0x0) returned 0x17 [0054.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\", lpFilePart=0x0) returned 0x18 [0054.958] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0054.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0054.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0054.958] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0054.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0054.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.958] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23 [0054.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24 [0054.959] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.959] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0054.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update", lpFilePart=0x0) returned 0x23 [0054.959] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\", lpFilePart=0x0) returned 0x24 [0054.959] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0054.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0054.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0054.960] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0054.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0054.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0054.960] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0054.960] SetFileAttributesW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", dwFileAttributes=0x80) returned 1 [0054.961] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.Horsuke", lpFilePart=0x0) returned 0x3a [0054.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0054.961] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml.Horsuke" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0054.962] GetFileType (hFile=0x228) returned 0x1 [0054.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0054.962] GetFileType (hFile=0x228) returned 0x1 [0055.460] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0055.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0055.460] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0055.460] GetFileType (hFile=0x15c) returned 0x1 [0055.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0055.460] GetFileType (hFile=0x15c) returned 0x1 [0055.460] ReadFile (in: hFile=0x15c, lpBuffer=0x225c360, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x225c360*, lpNumberOfBytesRead=0x2edee8*=0x77, lpOverlapped=0x0) returned 1 [0055.461] ReadFile (in: hFile=0x15c, lpBuffer=0x225c360, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x225c360*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0055.461] CloseHandle (hObject=0x15c) returned 1 [0055.462] WriteFile (in: hFile=0x228, lpBuffer=0x225a888*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x225a888*, lpNumberOfBytesWritten=0x2eddb8*=0xa0, lpOverlapped=0x0) returned 1 [0055.462] CloseHandle (hObject=0x228) returned 1 [0055.463] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml", lpFilePart=0x0) returned 0x32 [0055.463] DeleteFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\jaureglist.xml" (normalized: "c:\\programdata\\sun\\java\\java update\\jaureglist.xml")) returned 1 [0055.466] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0055.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0055.466] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.TXT" (normalized: "c:\\programdata\\sun\\java\\java update\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.466] GetFileType (hFile=0x228) returned 0x1 [0055.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0055.467] GetFileType (hFile=0x228) returned 0x1 [0055.467] WriteFile (in: hFile=0x228, lpBuffer=0x2266788*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2266788*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0055.468] CloseHandle (hObject=0x228) returned 1 [0055.468] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.png", lpFilePart=0x0) returned 0x2c [0055.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0055.468] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.png" (normalized: "c:\\programdata\\sun\\java\\java update\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.469] GetFileType (hFile=0x228) returned 0x1 [0055.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0055.469] GetFileType (hFile=0x228) returned 0x1 [0055.469] WriteFile (in: hFile=0x228, lpBuffer=0x2267818*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2267818*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0055.470] CloseHandle (hObject=0x228) returned 1 [0055.470] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0055.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0055.470] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\Hack.vbs" (normalized: "c:\\programdata\\sun\\java\\java update\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.471] GetFileType (hFile=0x228) returned 0x1 [0055.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0055.471] GetFileType (hFile=0x228) returned 0x1 [0055.471] WriteFile (in: hFile=0x228, lpBuffer=0x226b340*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x226b340*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0055.472] CloseHandle (hObject=0x228) returned 1 [0055.472] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Java Update\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0055.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0055.472] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Java Update\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\sun\\java\\java update\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.491] GetFileType (hFile=0x228) returned 0x1 [0055.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0055.491] GetFileType (hFile=0x228) returned 0x1 [0055.492] WriteFile (in: hFile=0x228, lpBuffer=0x226dd00*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x226dd00*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0055.493] CloseHandle (hObject=0x228) returned 1 [0055.495] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Hack.TXT", lpFilePart=0x0) returned 0x20 [0055.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0055.495] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.TXT" (normalized: "c:\\programdata\\sun\\java\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.496] GetFileType (hFile=0x228) returned 0x1 [0055.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0055.496] GetFileType (hFile=0x228) returned 0x1 [0055.496] WriteFile (in: hFile=0x228, lpBuffer=0x2277f78*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2277f78*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0055.497] CloseHandle (hObject=0x228) returned 1 [0055.498] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Hack.png", lpFilePart=0x0) returned 0x20 [0055.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0055.498] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.png" (normalized: "c:\\programdata\\sun\\java\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.498] GetFileType (hFile=0x228) returned 0x1 [0055.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0055.498] GetFileType (hFile=0x228) returned 0x1 [0055.498] WriteFile (in: hFile=0x228, lpBuffer=0x2278ff0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2278ff0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0055.500] CloseHandle (hObject=0x228) returned 1 [0055.500] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\Hack.vbs", lpFilePart=0x0) returned 0x20 [0055.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0055.500] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\Hack.vbs" (normalized: "c:\\programdata\\sun\\java\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.500] GetFileType (hFile=0x228) returned 0x1 [0055.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0055.501] GetFileType (hFile=0x228) returned 0x1 [0055.501] WriteFile (in: hFile=0x228, lpBuffer=0x227cad0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x227cad0*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0055.502] CloseHandle (hObject=0x228) returned 1 [0055.502] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Java\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Java\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4c [0055.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0055.502] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Java\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\sun\\java\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.508] GetFileType (hFile=0x228) returned 0x1 [0055.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0055.508] GetFileType (hFile=0x228) returned 0x1 [0055.508] WriteFile (in: hFile=0x228, lpBuffer=0x227f460*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x227f460*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0055.509] CloseHandle (hObject=0x228) returned 1 [0055.509] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Hack.TXT", lpFilePart=0x0) returned 0x1b [0055.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.509] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Hack.TXT" (normalized: "c:\\programdata\\sun\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.510] GetFileType (hFile=0x228) returned 0x1 [0055.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.510] GetFileType (hFile=0x228) returned 0x1 [0055.510] WriteFile (in: hFile=0x228, lpBuffer=0x22896b8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22896b8*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0055.511] CloseHandle (hObject=0x228) returned 1 [0055.512] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Hack.png", lpFilePart=0x0) returned 0x1b [0055.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0055.512] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Hack.png" (normalized: "c:\\programdata\\sun\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.512] GetFileType (hFile=0x228) returned 0x1 [0055.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0055.512] GetFileType (hFile=0x228) returned 0x1 [0055.512] WriteFile (in: hFile=0x228, lpBuffer=0x228a720*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x228a720*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0055.513] CloseHandle (hObject=0x228) returned 1 [0055.513] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\Hack.vbs", lpFilePart=0x0) returned 0x1b [0055.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.513] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\Hack.vbs" (normalized: "c:\\programdata\\sun\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.514] GetFileType (hFile=0x228) returned 0x1 [0055.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.514] GetFileType (hFile=0x228) returned 0x1 [0055.514] WriteFile (in: hFile=0x228, lpBuffer=0x228e1d0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x228e1d0*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0055.515] CloseHandle (hObject=0x228) returned 1 [0055.515] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Sun\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Sun\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x47 [0055.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.515] CreateFileW (lpFileName="C:\\ProgramData\\Sun\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\sun\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.516] GetFileType (hFile=0x228) returned 0x1 [0055.516] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.516] GetFileType (hFile=0x228) returned 0x1 [0055.516] WriteFile (in: hFile=0x228, lpBuffer=0x2290b40*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x2290b40*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0055.517] CloseHandle (hObject=0x228) returned 1 [0055.517] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0055.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates", lpFilePart=0x0) returned 0x18 [0055.517] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\", lpFilePart=0x0) returned 0x19 [0055.517] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Templates\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0xffffffffffffffff [0055.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf40) returned 1 [0055.521] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\Hack.TXT", lpFilePart=0x0) returned 0x21 [0055.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.521] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\Hack.TXT" (normalized: "c:\\programdata\\templates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.522] GetFileType (hFile=0x228) returned 0x1 [0055.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.522] GetFileType (hFile=0x228) returned 0x1 [0055.522] WriteFile (in: hFile=0x228, lpBuffer=0x229bfc8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x229bfc8*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0055.523] CloseHandle (hObject=0x228) returned 1 [0055.523] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\Hack.png", lpFilePart=0x0) returned 0x21 [0055.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0055.523] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\Hack.png" (normalized: "c:\\programdata\\templates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.524] GetFileType (hFile=0x228) returned 0x1 [0055.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0055.524] GetFileType (hFile=0x228) returned 0x1 [0055.524] WriteFile (in: hFile=0x228, lpBuffer=0x229d040*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x229d040*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0055.525] CloseHandle (hObject=0x228) returned 1 [0055.525] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\Hack.vbs", lpFilePart=0x0) returned 0x21 [0055.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.525] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\Hack.vbs" (normalized: "c:\\programdata\\templates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.526] GetFileType (hFile=0x228) returned 0x1 [0055.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.526] GetFileType (hFile=0x228) returned 0x1 [0055.526] WriteFile (in: hFile=0x228, lpBuffer=0x22a0b20*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x22a0b20*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0055.527] CloseHandle (hObject=0x228) returned 1 [0055.527] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4d [0055.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.527] CreateFileW (lpFileName="C:\\ProgramData\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\templates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.545] GetFileType (hFile=0x228) returned 0x1 [0055.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.545] GetFileType (hFile=0x228) returned 0x1 [0055.546] WriteFile (in: hFile=0x228, lpBuffer=0x22a34b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22a34b0*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0055.546] CloseHandle (hObject=0x228) returned 1 [0055.548] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Hack.TXT", lpFilePart=0x0) returned 0x17 [0055.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.548] CreateFileW (lpFileName="C:\\ProgramData\\Hack.TXT" (normalized: "c:\\programdata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.549] GetFileType (hFile=0x228) returned 0x1 [0055.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0055.549] GetFileType (hFile=0x228) returned 0x1 [0055.549] WriteFile (in: hFile=0x228, lpBuffer=0x22ad6f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x22ad6f8*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0055.550] CloseHandle (hObject=0x228) returned 1 [0055.550] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Hack.png", lpFilePart=0x0) returned 0x17 [0055.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0055.550] CreateFileW (lpFileName="C:\\ProgramData\\Hack.png" (normalized: "c:\\programdata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.551] GetFileType (hFile=0x228) returned 0x1 [0055.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0055.551] GetFileType (hFile=0x228) returned 0x1 [0055.551] WriteFile (in: hFile=0x228, lpBuffer=0x22ae758*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x22ae758*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0055.552] CloseHandle (hObject=0x228) returned 1 [0055.552] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\Hack.vbs", lpFilePart=0x0) returned 0x17 [0055.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.552] CreateFileW (lpFileName="C:\\ProgramData\\Hack.vbs" (normalized: "c:\\programdata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.553] GetFileType (hFile=0x228) returned 0x1 [0055.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0055.553] GetFileType (hFile=0x228) returned 0x1 [0055.553] WriteFile (in: hFile=0x228, lpBuffer=0x22b21f0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x22b21f0*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0055.554] CloseHandle (hObject=0x228) returned 1 [0055.554] GetFullPathNameW (in: lpFileName="C:\\ProgramData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\ProgramData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x43 [0055.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.554] CreateFileW (lpFileName="C:\\ProgramData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\programdata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.555] GetFileType (hFile=0x228) returned 0x1 [0055.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0055.555] GetFileType (hFile=0x228) returned 0x1 [0055.555] WriteFile (in: hFile=0x228, lpBuffer=0x22b4b50*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x22b4b50*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0055.558] CloseHandle (hObject=0x228) returned 1 [0055.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0055.558] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0055.558] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0055.558] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0055.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.559] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0055.559] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0055.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0055.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0055.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0055.560] GetFullPathNameW (in: lpFileName="C:\\Recovery", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery", lpFilePart=0x0) returned 0xb [0055.560] GetFullPathNameW (in: lpFileName="C:\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\", lpFilePart=0x0) returned 0xc [0055.560] FindFirstFileW (in: lpFileName="C:\\Recovery\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0055.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0055.560] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0055.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0055.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0055.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0055.560] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30 [0055.560] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31 [0055.560] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0055.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0055.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0055.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0055.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0055.561] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0055.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0055.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0055.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0055.561] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b", lpFilePart=0x0) returned 0x30 [0055.561] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\", lpFilePart=0x0) returned 0x31 [0055.561] FindFirstFileW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0055.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0055.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0055.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0055.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0055.562] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0055.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0055.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0055.562] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0055.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.562] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.TXT" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.562] GetFileType (hFile=0x228) returned 0x1 [0055.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.562] GetFileType (hFile=0x228) returned 0x1 [0055.562] WriteFile (in: hFile=0x228, lpBuffer=0x22c2b48*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22c2b48*, lpNumberOfBytesWritten=0x2edef8*=0x39b, lpOverlapped=0x0) returned 1 [0055.563] CloseHandle (hObject=0x228) returned 1 [0055.564] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.png", lpFilePart=0x0) returned 0x39 [0055.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0055.564] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.png" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.564] GetFileType (hFile=0x228) returned 0x1 [0055.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0055.564] GetFileType (hFile=0x228) returned 0x1 [0055.564] WriteFile (in: hFile=0x228, lpBuffer=0x22c3bf0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x22c3bf0*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0055.565] CloseHandle (hObject=0x228) returned 1 [0055.565] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0055.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.565] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\Hack.vbs" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.573] GetFileType (hFile=0x228) returned 0x1 [0055.573] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.573] GetFileType (hFile=0x228) returned 0x1 [0055.573] WriteFile (in: hFile=0x228, lpBuffer=0x22c7760*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede98, lpOverlapped=0x0 | out: lpBuffer=0x22c7760*, lpNumberOfBytesWritten=0x2ede98*=0x13c, lpOverlapped=0x0) returned 1 [0055.574] CloseHandle (hObject=0x228) returned 1 [0055.574] GetFullPathNameW (in: lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0055.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0055.574] CreateFileW (lpFileName="C:\\Recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\recovery\\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.574] GetFileType (hFile=0x228) returned 0x1 [0055.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0055.574] GetFileType (hFile=0x228) returned 0x1 [0055.574] WriteFile (in: hFile=0x228, lpBuffer=0x22ca150*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edef8, lpOverlapped=0x0 | out: lpBuffer=0x22ca150*, lpNumberOfBytesWritten=0x2edef8*=0xc6, lpOverlapped=0x0) returned 1 [0055.575] CloseHandle (hObject=0x228) returned 1 [0055.575] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Hack.TXT", lpFilePart=0x0) returned 0x14 [0055.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.575] CreateFileW (lpFileName="C:\\Recovery\\Hack.TXT" (normalized: "c:\\recovery\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.575] GetFileType (hFile=0x228) returned 0x1 [0055.575] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0055.575] GetFileType (hFile=0x228) returned 0x1 [0055.575] WriteFile (in: hFile=0x228, lpBuffer=0x22d4398*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x22d4398*, lpNumberOfBytesWritten=0x2edf78*=0x39b, lpOverlapped=0x0) returned 1 [0055.576] CloseHandle (hObject=0x228) returned 1 [0055.576] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Hack.png", lpFilePart=0x0) returned 0x14 [0055.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0055.576] CreateFileW (lpFileName="C:\\Recovery\\Hack.png" (normalized: "c:\\recovery\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.577] GetFileType (hFile=0x228) returned 0x1 [0055.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf00) returned 1 [0055.577] GetFileType (hFile=0x228) returned 0x1 [0055.577] WriteFile (in: hFile=0x228, lpBuffer=0x22d53f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee0b8, lpOverlapped=0x0 | out: lpBuffer=0x22d53f8*, lpNumberOfBytesWritten=0x2ee0b8*=0x2337, lpOverlapped=0x0) returned 1 [0055.578] CloseHandle (hObject=0x228) returned 1 [0055.578] GetFullPathNameW (in: lpFileName="C:\\Recovery\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\Hack.vbs", lpFilePart=0x0) returned 0x14 [0055.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.578] CreateFileW (lpFileName="C:\\Recovery\\Hack.vbs" (normalized: "c:\\recovery\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.578] GetFileType (hFile=0x228) returned 0x1 [0055.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0055.578] GetFileType (hFile=0x228) returned 0x1 [0055.578] WriteFile (in: hFile=0x228, lpBuffer=0x22d8e90*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edf18, lpOverlapped=0x0 | out: lpBuffer=0x22d8e90*, lpNumberOfBytesWritten=0x2edf18*=0x13c, lpOverlapped=0x0) returned 1 [0055.579] CloseHandle (hObject=0x228) returned 1 [0055.579] GetFullPathNameW (in: lpFileName="C:\\Recovery\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\Recovery\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x40 [0055.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.579] CreateFileW (lpFileName="C:\\Recovery\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\recovery\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0055.599] GetFileType (hFile=0x228) returned 0x1 [0055.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0055.599] GetFileType (hFile=0x228) returned 0x1 [0055.599] WriteFile (in: hFile=0x228, lpBuffer=0x22db7f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edf78, lpOverlapped=0x0 | out: lpBuffer=0x22db7f0*, lpNumberOfBytesWritten=0x2edf78*=0xc6, lpOverlapped=0x0) returned 1 [0055.600] CloseHandle (hObject=0x228) returned 1 [0055.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0055.600] GetFullPathNameW (in: lpFileName="C:\\System Volume Information", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information", lpFilePart=0x0) returned 0x1c [0055.600] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\", lpFilePart=0x0) returned 0x1d [0055.600] FindFirstFileW (in: lpFileName="C:\\System Volume Information\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0xffffffffffffffff [0055.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfc0) returned 1 [0055.604] GetFullPathNameW (in: lpFileName="C:\\System Volume Information\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed9f0, lpFilePart=0x0 | out: lpBuffer="C:\\System Volume Information\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0055.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eded0) returned 1 [0055.604] CreateFileW (lpFileName="C:\\System Volume Information\\Hack.TXT" (normalized: "c:\\system volume information\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0055.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ea810) returned 1 [0055.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0055.606] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0055.606] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0055.606] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0055.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0055.608] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0055.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0055.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0055.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee090) returned 1 [0055.608] GetFullPathNameW (in: lpFileName="C:\\Users", nBufferLength=0x105, lpBuffer=0x2edb80, lpFilePart=0x0 | out: lpBuffer="C:\\Users", lpFilePart=0x0) returned 0x8 [0055.608] GetFullPathNameW (in: lpFileName="C:\\Users\\", nBufferLength=0x105, lpBuffer=0x2edb20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\", lpFilePart=0x0) returned 0x9 [0055.608] FindFirstFileW (in: lpFileName="C:\\Users\\*", lpFindFileData=0x2edd30 | out: lpFindFileData=0x2edd30) returned 0x4cf840 [0055.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 1 [0055.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd80 | out: lpFindFileData=0x2edd80) returned 0 [0055.609] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0055.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfe0) returned 1 [0055.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edfa0) returned 1 [0055.610] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edc30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.png", lpFilePart=0x0) returned 0x11 [0055.610] SetFileAttributesW (lpFileName="C:\\Users\\Hack.png", dwFileAttributes=0x80) returned 1 [0055.610] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2eda50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x19 [0055.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf30) returned 1 [0055.610] CreateFileW (lpFileName="C:\\Users\\Hack.png.Horsuke" (normalized: "c:\\users\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0055.611] GetFileType (hFile=0x228) returned 0x1 [0055.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0055.611] GetFileType (hFile=0x228) returned 0x1 [0056.192] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda50, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.png", lpFilePart=0x0) returned 0x11 [0056.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf30) returned 1 [0056.193] CreateFileW (lpFileName="C:\\Users\\Hack.png" (normalized: "c:\\users\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0056.193] GetFileType (hFile=0x15c) returned 0x1 [0056.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0056.193] GetFileType (hFile=0x15c) returned 0x1 [0056.193] ReadFile (in: hFile=0x15c, lpBuffer=0x23d0680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ee068, lpOverlapped=0x0 | out: lpBuffer=0x23d0680*, lpNumberOfBytesRead=0x2ee068*=0x1000, lpOverlapped=0x0) returned 1 [0056.197] WriteFile (in: hFile=0x228, lpBuffer=0x23cebf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edff8, lpOverlapped=0x0 | out: lpBuffer=0x23cebf0*, lpNumberOfBytesWritten=0x2edff8*=0x1000, lpOverlapped=0x0) returned 1 [0056.198] ReadFile (in: hFile=0x15c, lpBuffer=0x23d0680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ee068, lpOverlapped=0x0 | out: lpBuffer=0x23d0680*, lpNumberOfBytesRead=0x2ee068*=0x1000, lpOverlapped=0x0) returned 1 [0056.198] WriteFile (in: hFile=0x228, lpBuffer=0x23cebf0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edff8, lpOverlapped=0x0 | out: lpBuffer=0x23cebf0*, lpNumberOfBytesWritten=0x2edff8*=0x1000, lpOverlapped=0x0) returned 1 [0056.198] ReadFile (in: hFile=0x15c, lpBuffer=0x23d0680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ee068, lpOverlapped=0x0 | out: lpBuffer=0x23d0680*, lpNumberOfBytesRead=0x2ee068*=0x337, lpOverlapped=0x0) returned 1 [0056.198] ReadFile (in: hFile=0x15c, lpBuffer=0x23d0680, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ee068, lpOverlapped=0x0 | out: lpBuffer=0x23d0680*, lpNumberOfBytesRead=0x2ee068*=0x0, lpOverlapped=0x0) returned 1 [0056.198] CloseHandle (hObject=0x15c) returned 1 [0056.198] WriteFile (in: hFile=0x228, lpBuffer=0x23cebf0*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23cebf0*, lpNumberOfBytesWritten=0x2edf38*=0x360, lpOverlapped=0x0) returned 1 [0056.199] CloseHandle (hObject=0x228) returned 1 [0056.199] GetFullPathNameW (in: lpFileName="C:\\Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\Hack.png", lpFilePart=0x0) returned 0x11 [0056.199] DeleteFileW (lpFileName="C:\\Users\\Hack.png" (normalized: "c:\\users\\hack.png")) returned 1 [0056.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0056.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0056.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e [0056.200] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0056.204] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0056.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0056.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0056.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFilePart=0x0) returned 0x1d [0056.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\", lpFilePart=0x0) returned 0x1e [0056.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf840 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0056.208] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0056.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0056.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0056.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25 [0056.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26 [0056.208] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0056.209] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0056.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0056.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0056.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData", lpFilePart=0x0) returned 0x25 [0056.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\", lpFilePart=0x0) returned 0x26 [0056.209] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf840 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0056.209] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0056.210] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0056.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0056.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0056.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0056.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0056.210] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0056.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.210] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.211] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0056.211] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0056.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0056.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0056.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local", lpFilePart=0x0) returned 0x2b [0056.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\", lpFilePart=0x0) returned 0x2c [0056.212] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0056.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0056.213] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0056.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0056.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0056.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32 [0056.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.214] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe", lpFilePart=0x0) returned 0x31 [0056.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\", lpFilePart=0x0) returned 0x32 [0056.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0056.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a [0056.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.216] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x39 [0056.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3a [0056.216] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.216] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0056.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f [0056.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.217] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.217] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.218] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.218] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x3e [0056.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x3f [0056.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.219] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0056.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45 [0056.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.222] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache", lpFilePart=0x0) returned 0x44 [0056.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\", lpFilePart=0x0) returned 0x45 [0056.222] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.222] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.TXT", lpFilePart=0x0) returned 0x4d [0056.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.223] GetFileType (hFile=0x228) returned 0x1 [0056.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.223] GetFileType (hFile=0x228) returned 0x1 [0056.223] WriteFile (in: hFile=0x228, lpBuffer=0x23f5b10*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23f5b10*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0056.224] CloseHandle (hObject=0x228) returned 1 [0056.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.png", lpFilePart=0x0) returned 0x4d [0056.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.224] GetFileType (hFile=0x228) returned 0x1 [0056.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0056.224] GetFileType (hFile=0x228) returned 0x1 [0056.225] WriteFile (in: hFile=0x228, lpBuffer=0x23f6be0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23f6be0*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0056.225] CloseHandle (hObject=0x228) returned 1 [0056.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.vbs", lpFilePart=0x0) returned 0x4d [0056.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x79 [0056.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0056.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x47 [0056.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0056.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0056.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0056.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.TXT", lpFilePart=0x0) returned 0x42 [0056.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x42 [0056.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0056.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.vbs", lpFilePart=0x0) returned 0x42 [0056.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6e [0056.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0056.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38 [0056.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.272] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color", lpFilePart=0x0) returned 0x37 [0056.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\", lpFilePart=0x0) returned 0x38 [0056.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.273] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0056.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41 [0056.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.274] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles", lpFilePart=0x0) returned 0x40 [0056.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\", lpFilePart=0x0) returned 0x41 [0056.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.275] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0056.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.279] WriteFile (in: hFile=0x228, lpBuffer=0x2231d80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2231d80*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0056.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.png", lpFilePart=0x0) returned 0x49 [0056.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.280] GetFileType (hFile=0x228) returned 0x1 [0056.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0056.280] GetFileType (hFile=0x228) returned 0x1 [0056.280] WriteFile (in: hFile=0x228, lpBuffer=0x2232e48*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2232e48*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0056.281] CloseHandle (hObject=0x228) returned 1 [0056.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0056.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.282] GetFileType (hFile=0x228) returned 0x1 [0056.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.282] GetFileType (hFile=0x228) returned 0x1 [0056.282] WriteFile (in: hFile=0x228, lpBuffer=0x2236a18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x2236a18*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0056.282] CloseHandle (hObject=0x228) returned 1 [0056.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0056.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.288] GetFileType (hFile=0x228) returned 0x1 [0056.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.288] GetFileType (hFile=0x228) returned 0x1 [0056.289] WriteFile (in: hFile=0x228, lpBuffer=0x2239448*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2239448*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0056.289] CloseHandle (hObject=0x228) returned 1 [0056.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.TXT", lpFilePart=0x0) returned 0x40 [0056.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.292] GetFileType (hFile=0x228) returned 0x1 [0056.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.292] GetFileType (hFile=0x228) returned 0x1 [0056.292] WriteFile (in: hFile=0x228, lpBuffer=0x2243740*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2243740*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0056.293] CloseHandle (hObject=0x228) returned 1 [0056.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.png", lpFilePart=0x0) returned 0x40 [0056.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.294] GetFileType (hFile=0x228) returned 0x1 [0056.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0056.294] GetFileType (hFile=0x228) returned 0x1 [0056.294] WriteFile (in: hFile=0x228, lpBuffer=0x22447f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22447f8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0056.295] CloseHandle (hObject=0x228) returned 1 [0056.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.vbs", lpFilePart=0x0) returned 0x40 [0056.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.295] GetFileType (hFile=0x228) returned 0x1 [0056.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.295] GetFileType (hFile=0x228) returned 0x1 [0056.295] WriteFile (in: hFile=0x228, lpBuffer=0x2248398*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2248398*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0056.296] CloseHandle (hObject=0x228) returned 1 [0056.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6c [0056.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.306] GetFileType (hFile=0x228) returned 0x1 [0056.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.306] GetFileType (hFile=0x228) returned 0x1 [0056.306] WriteFile (in: hFile=0x228, lpBuffer=0x224ada8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x224ada8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0056.307] CloseHandle (hObject=0x228) returned 1 [0056.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.TXT", lpFilePart=0x0) returned 0x3a [0056.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.308] GetFileType (hFile=0x228) returned 0x1 [0056.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.308] GetFileType (hFile=0x228) returned 0x1 [0056.308] WriteFile (in: hFile=0x228, lpBuffer=0x2255080*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2255080*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0056.309] CloseHandle (hObject=0x228) returned 1 [0056.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x3a [0056.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.310] GetFileType (hFile=0x228) returned 0x1 [0056.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0056.310] GetFileType (hFile=0x228) returned 0x1 [0056.310] WriteFile (in: hFile=0x228, lpBuffer=0x2256128*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2256128*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0056.311] CloseHandle (hObject=0x228) returned 1 [0056.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.vbs", lpFilePart=0x0) returned 0x3a [0056.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.311] GetFileType (hFile=0x228) returned 0x1 [0056.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.311] GetFileType (hFile=0x228) returned 0x1 [0056.311] WriteFile (in: hFile=0x228, lpBuffer=0x2259c98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2259c98*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0056.312] CloseHandle (hObject=0x228) returned 1 [0056.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x66 [0056.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.324] GetFileType (hFile=0x228) returned 0x1 [0056.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.324] GetFileType (hFile=0x228) returned 0x1 [0056.325] WriteFile (in: hFile=0x228, lpBuffer=0x225c688*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x225c688*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0056.325] CloseHandle (hObject=0x228) returned 1 [0056.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data", lpFilePart=0x0) returned 0x3c [0056.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\", lpFilePart=0x0) returned 0x3d [0056.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0xffffffffffffffff [0056.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0056.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.TXT", lpFilePart=0x0) returned 0x45 [0056.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.330] GetFileType (hFile=0x228) returned 0x1 [0056.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.330] GetFileType (hFile=0x228) returned 0x1 [0056.331] WriteFile (in: hFile=0x228, lpBuffer=0x2267e70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2267e70*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0056.331] CloseHandle (hObject=0x228) returned 1 [0056.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.png", lpFilePart=0x0) returned 0x45 [0056.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.332] GetFileType (hFile=0x228) returned 0x1 [0056.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0056.332] GetFileType (hFile=0x228) returned 0x1 [0056.332] WriteFile (in: hFile=0x228, lpBuffer=0x2268f30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2268f30*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0056.333] CloseHandle (hObject=0x228) returned 1 [0056.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.vbs", lpFilePart=0x0) returned 0x45 [0056.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.334] GetFileType (hFile=0x228) returned 0x1 [0056.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.334] GetFileType (hFile=0x228) returned 0x1 [0056.334] WriteFile (in: hFile=0x228, lpBuffer=0x226cae8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x226cae8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0056.334] CloseHandle (hObject=0x228) returned 1 [0056.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x71 [0056.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.335] GetFileType (hFile=0x228) returned 0x1 [0056.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.335] GetFileType (hFile=0x228) returned 0x1 [0056.335] WriteFile (in: hFile=0x228, lpBuffer=0x226f508*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x226f508*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0056.336] CloseHandle (hObject=0x228) returned 1 [0056.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0056.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31 [0056.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.337] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps", lpFilePart=0x0) returned 0x30 [0056.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\", lpFilePart=0x0) returned 0x31 [0056.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.338] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0056.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35 [0056.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.339] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0", lpFilePart=0x0) returned 0x34 [0056.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\", lpFilePart=0x0) returned 0x35 [0056.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.340] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0056.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a [0056.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.341] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data", lpFilePart=0x0) returned 0x39 [0056.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\", lpFilePart=0x0) returned 0x3a [0056.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.342] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.342] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0056.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47 [0056.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.342] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.342] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.342] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.343] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7", lpFilePart=0x0) returned 0x46 [0056.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\", lpFilePart=0x0) returned 0x47 [0056.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.343] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.343] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.343] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.343] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", lpFilePart=0x0) returned 0x53 [0056.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", lpFilePart=0x0) returned 0x54 [0056.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.344] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ", lpFilePart=0x0) returned 0x53 [0056.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\", lpFilePart=0x0) returned 0x54 [0056.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.345] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.345] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.345] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x8a [0056.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x8b [0056.345] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0056.346] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0056.346] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0056.346] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0056.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0056.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x8a [0056.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x8b [0056.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0056.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0056.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0056.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0056.347] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0056.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0056.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", lpFilePart=0x0) returned 0x8f [0056.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", lpFilePart=0x0) returned 0x90 [0056.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0056.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0056.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0056.348] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0056.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0056.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data", lpFilePart=0x0) returned 0x8f [0056.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\", lpFilePart=0x0) returned 0x90 [0056.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0056.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0056.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0056.349] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0056.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0056.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.TXT", lpFilePart=0x0) returned 0x98 [0056.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0056.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.350] GetFileType (hFile=0x228) returned 0x1 [0056.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0056.350] GetFileType (hFile=0x228) returned 0x1 [0056.351] WriteFile (in: hFile=0x228, lpBuffer=0x228b568*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x228b568*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0056.351] CloseHandle (hObject=0x228) returned 1 [0056.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.png", lpFilePart=0x0) returned 0x98 [0056.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0056.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.352] GetFileType (hFile=0x228) returned 0x1 [0056.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0056.352] GetFileType (hFile=0x228) returned 0x1 [0056.352] WriteFile (in: hFile=0x228, lpBuffer=0x228c6d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x228c6d0*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0056.353] CloseHandle (hObject=0x228) returned 1 [0056.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.vbs", lpFilePart=0x0) returned 0x98 [0056.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0056.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.354] GetFileType (hFile=0x228) returned 0x1 [0056.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0056.354] GetFileType (hFile=0x228) returned 0x1 [0056.354] WriteFile (in: hFile=0x228, lpBuffer=0x2290480*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x2290480*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0056.355] CloseHandle (hObject=0x228) returned 1 [0056.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc4 [0056.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0056.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.355] GetFileType (hFile=0x228) returned 0x1 [0056.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0056.355] GetFileType (hFile=0x228) returned 0x1 [0056.355] WriteFile (in: hFile=0x228, lpBuffer=0x2292ff0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x2292ff0*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0056.356] CloseHandle (hObject=0x228) returned 1 [0056.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0056.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0056.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.357] GetFileType (hFile=0x228) returned 0x1 [0056.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0056.357] GetFileType (hFile=0x228) returned 0x1 [0056.357] WriteFile (in: hFile=0x228, lpBuffer=0x229d428*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x229d428*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0056.358] CloseHandle (hObject=0x228) returned 1 [0056.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.png", lpFilePart=0x0) returned 0x93 [0056.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0056.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.358] GetFileType (hFile=0x228) returned 0x1 [0056.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0056.358] GetFileType (hFile=0x228) returned 0x1 [0056.358] WriteFile (in: hFile=0x228, lpBuffer=0x229e580*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x229e580*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0056.359] CloseHandle (hObject=0x228) returned 1 [0056.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0056.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0056.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.360] GetFileType (hFile=0x228) returned 0x1 [0056.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0056.360] GetFileType (hFile=0x228) returned 0x1 [0056.360] WriteFile (in: hFile=0x228, lpBuffer=0x22a2300*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x22a2300*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0056.361] CloseHandle (hObject=0x228) returned 1 [0056.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0056.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0056.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.369] GetFileType (hFile=0x228) returned 0x1 [0056.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0056.369] GetFileType (hFile=0x228) returned 0x1 [0056.370] WriteFile (in: hFile=0x228, lpBuffer=0x22a4e50*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22a4e50*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0056.370] CloseHandle (hObject=0x228) returned 1 [0056.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0056.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.371] GetFileType (hFile=0x228) returned 0x1 [0056.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.371] GetFileType (hFile=0x228) returned 0x1 [0056.372] WriteFile (in: hFile=0x228, lpBuffer=0x22af1b8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x22af1b8*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0056.372] CloseHandle (hObject=0x228) returned 1 [0056.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.png", lpFilePart=0x0) returned 0x5c [0056.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.373] GetFileType (hFile=0x228) returned 0x1 [0056.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0056.373] GetFileType (hFile=0x228) returned 0x1 [0056.373] WriteFile (in: hFile=0x228, lpBuffer=0x22b02a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22b02a8*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0056.374] CloseHandle (hObject=0x228) returned 1 [0056.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0056.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.374] GetFileType (hFile=0x228) returned 0x1 [0056.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.375] GetFileType (hFile=0x228) returned 0x1 [0056.375] WriteFile (in: hFile=0x228, lpBuffer=0x22b3ef0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x22b3ef0*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0056.375] CloseHandle (hObject=0x228) returned 1 [0056.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0056.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.378] GetFileType (hFile=0x228) returned 0x1 [0056.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.378] GetFileType (hFile=0x228) returned 0x1 [0056.378] WriteFile (in: hFile=0x228, lpBuffer=0x22b6970*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x22b6970*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0056.379] CloseHandle (hObject=0x228) returned 1 [0056.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.TXT", lpFilePart=0x0) returned 0x4f [0056.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.379] GetFileType (hFile=0x228) returned 0x1 [0056.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.379] GetFileType (hFile=0x228) returned 0x1 [0056.380] WriteFile (in: hFile=0x228, lpBuffer=0x22c0c98*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22c0c98*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0056.381] CloseHandle (hObject=0x228) returned 1 [0056.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.png", lpFilePart=0x0) returned 0x4f [0056.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.381] GetFileType (hFile=0x228) returned 0x1 [0056.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0056.381] GetFileType (hFile=0x228) returned 0x1 [0056.381] WriteFile (in: hFile=0x228, lpBuffer=0x22c1d68*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22c1d68*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0056.382] CloseHandle (hObject=0x228) returned 1 [0056.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.vbs", lpFilePart=0x0) returned 0x4f [0056.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.383] GetFileType (hFile=0x228) returned 0x1 [0056.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.383] GetFileType (hFile=0x228) returned 0x1 [0056.383] WriteFile (in: hFile=0x228, lpBuffer=0x22c5950*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x22c5950*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0056.384] CloseHandle (hObject=0x228) returned 1 [0056.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7b [0056.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\cjw3o3kp.bx7\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.396] GetFileType (hFile=0x228) returned 0x1 [0056.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.396] GetFileType (hFile=0x228) returned 0x1 [0056.396] WriteFile (in: hFile=0x228, lpBuffer=0x22c8390*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22c8390*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0056.397] CloseHandle (hObject=0x228) returned 1 [0056.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.TXT", lpFilePart=0x0) returned 0x42 [0056.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.397] GetFileType (hFile=0x228) returned 0x1 [0056.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.png", lpFilePart=0x0) returned 0x42 [0056.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0056.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.vbs", lpFilePart=0x0) returned 0x42 [0056.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6e [0056.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0056.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42 [0056.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.406] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.406] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.406] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.407] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX", lpFilePart=0x0) returned 0x41 [0056.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\", lpFilePart=0x0) returned 0x42 [0056.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.407] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0056.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f [0056.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.419] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.419] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT", lpFilePart=0x0) returned 0x4e [0056.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\", lpFilePart=0x0) returned 0x4f [0056.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.421] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.421] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpFilePart=0x0) returned 0x8a [0056.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", lpFilePart=0x0) returned 0x8b [0056.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.423] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", lpFilePart=0x0) returned 0x8a [0056.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\", lpFilePart=0x0) returned 0x8b [0056.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.424] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0056.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.png", lpFilePart=0x0) returned 0x93 [0056.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0056.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0056.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0056.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x85 [0056.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x86 [0056.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.441] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", lpFilePart=0x0) returned 0x85 [0056.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\", lpFilePart=0x0) returned 0x86 [0056.442] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.442] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.442] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.443] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.TXT", lpFilePart=0x0) returned 0x8e [0056.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.png", lpFilePart=0x0) returned 0x8e [0056.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0056.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.vbs", lpFilePart=0x0) returned 0x8e [0056.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xba [0056.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", lpFilePart=0x0) returned 0x58 [0056.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", lpFilePart=0x0) returned 0x59 [0056.449] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.460] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.460] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.460] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.461] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.461] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.461] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.461] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests", lpFilePart=0x0) returned 0x58 [0056.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\", lpFilePart=0x0) returned 0x59 [0056.462] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.463] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0056.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.png", lpFilePart=0x0) returned 0x61 [0056.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0056.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0056.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0056.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.TXT", lpFilePart=0x0) returned 0x57 [0056.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.470] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.png", lpFilePart=0x0) returned 0x57 [0056.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0056.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.vbs", lpFilePart=0x0) returned 0x57 [0056.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x83 [0056.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0056.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.png", lpFilePart=0x0) returned 0x4a [0056.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0056.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0056.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0056.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0056.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0056.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.TXT", lpFilePart=0x0) returned 0x3d [0056.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.png", lpFilePart=0x0) returned 0x3d [0056.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0056.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.vbs", lpFilePart=0x0) returned 0x3d [0056.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x69 [0056.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0056.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0056.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0056.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.png", lpFilePart=0x0) returned 0x39 [0056.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0056.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0056.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0056.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0056.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37 [0056.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.492] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment", lpFilePart=0x0) returned 0x36 [0056.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\", lpFilePart=0x0) returned 0x37 [0056.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.493] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.493] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.493] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.TXT", lpFilePart=0x0) returned 0x3f [0056.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.png", lpFilePart=0x0) returned 0x3f [0056.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0056.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.vbs", lpFilePart=0x0) returned 0x3f [0056.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6b [0056.496] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0056.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Deployment\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\deployment\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0056.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0056.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33 [0056.512] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.513] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.513] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.513] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.513] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.513] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0056.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google", lpFilePart=0x0) returned 0x32 [0056.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\", lpFilePart=0x0) returned 0x33 [0056.513] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0056.513] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.513] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.514] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0056.514] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0056.514] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0056.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0056.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0056.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a [0056.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.514] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.514] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.514] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.514] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0056.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome", lpFilePart=0x0) returned 0x39 [0056.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\", lpFilePart=0x0) returned 0x3a [0056.514] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0056.515] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.515] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0056.515] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0056.515] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0056.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0056.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0056.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44 [0056.515] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.522] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.523] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0056.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data", lpFilePart=0x0) returned 0x43 [0056.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\", lpFilePart=0x0) returned 0x44 [0056.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0056.526] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0056.526] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0056.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0056.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0056.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c [0056.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.533] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency", lpFilePart=0x0) returned 0x5b [0056.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\", lpFilePart=0x0) returned 0x5c [0056.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.534] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.534] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.534] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0056.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.png", lpFilePart=0x0) returned 0x64 [0056.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0056.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0056.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0056.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\CertificateTransparency\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\certificatetransparency\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0056.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d [0056.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.551] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.551] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.551] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.551] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.551] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.551] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0056.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad", lpFilePart=0x0) returned 0x4c [0056.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\", lpFilePart=0x0) returned 0x4d [0056.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.552] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0056.552] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0056.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x54 [0056.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x55 [0056.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.553] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0056.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports", lpFilePart=0x0) returned 0x54 [0056.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\", lpFilePart=0x0) returned 0x55 [0056.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0056.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0056.554] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0056.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0056.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0056.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.png", lpFilePart=0x0) returned 0x5d [0056.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0056.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0056.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0056.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0056.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0056.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\reports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\reports\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0056.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.TXT", lpFilePart=0x0) returned 0x55 [0056.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.png", lpFilePart=0x0) returned 0x55 [0056.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0056.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0056.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.vbs", lpFilePart=0x0) returned 0x55 [0056.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0056.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x81 [0056.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0056.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0056.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0056.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c [0056.570] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.581] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.582] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.583] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.584] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.585] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.585] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.585] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0056.585] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default", lpFilePart=0x0) returned 0x4b [0056.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\", lpFilePart=0x0) returned 0x4c [0056.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.588] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.588] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0056.588] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x51 [0056.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x52 [0056.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.590] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache", lpFilePart=0x0) returned 0x51 [0056.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\", lpFilePart=0x0) returned 0x52 [0056.590] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.590] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0056.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.png", lpFilePart=0x0) returned 0x5a [0056.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0056.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0056.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x68 [0056.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x69 [0056.597] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb", lpFilePart=0x0) returned 0x68 [0056.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\", lpFilePart=0x0) returned 0x69 [0056.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.616] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.TXT", lpFilePart=0x0) returned 0x71 [0056.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.png", lpFilePart=0x0) returned 0x71 [0056.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\Hack.vbs", lpFilePart=0x0) returned 0x71 [0056.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9d [0056.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x5b [0056.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x5c [0056.623] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.629] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules", lpFilePart=0x0) returned 0x5b [0056.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\", lpFilePart=0x0) returned 0x5c [0056.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.631] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0056.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.png", lpFilePart=0x0) returned 0x64 [0056.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0056.635] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0056.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x5b [0056.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x5c [0056.638] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.648] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State", lpFilePart=0x0) returned 0x5b [0056.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\", lpFilePart=0x0) returned 0x5c [0056.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.649] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0056.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.png", lpFilePart=0x0) returned 0x64 [0056.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0056.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0056.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x56 [0056.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x57 [0056.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.687] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions", lpFilePart=0x0) returned 0x56 [0056.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\", lpFilePart=0x0) returned 0x57 [0056.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0056.690] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x77 [0056.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x78 [0056.691] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0056.701] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek", lpFilePart=0x0) returned 0x77 [0056.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\", lpFilePart=0x0) returned 0x78 [0056.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0056.702] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x7d [0056.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x7e [0056.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0056.718] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0", lpFilePart=0x0) returned 0x7d [0056.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\", lpFilePart=0x0) returned 0x7e [0056.719] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0056.721] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0056.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0056.721] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", dwFileAttributes=0x80) returned 1 [0056.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.Horsuke", lpFilePart=0x0) returned 0x92 [0056.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0056.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0056.724] GetFileType (hFile=0x228) returned 0x1 [0056.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0056.724] GetFileType (hFile=0x228) returned 0x1 [0057.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0057.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0057.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0057.189] GetFileType (hFile=0x15c) returned 0x1 [0057.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0057.189] GetFileType (hFile=0x15c) returned 0x1 [0057.189] ReadFile (in: hFile=0x15c, lpBuffer=0x2322e70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2322e70*, lpNumberOfBytesRead=0x2edb68*=0xd2c, lpOverlapped=0x0) returned 1 [0057.209] ReadFile (in: hFile=0x15c, lpBuffer=0x2322b84, nNumberOfBytesToRead=0x2d4, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2322b84*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0057.209] ReadFile (in: hFile=0x15c, lpBuffer=0x2322e70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2322e70*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0057.210] CloseHandle (hObject=0x15c) returned 1 [0057.210] WriteFile (in: hFile=0x228, lpBuffer=0x23212e8*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x23212e8*, lpNumberOfBytesWritten=0x2eda38*=0xd50, lpOverlapped=0x0) returned 1 [0057.211] CloseHandle (hObject=0x228) returned 1 [0057.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0057.211] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0057.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0057.212] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", dwFileAttributes=0x80) returned 1 [0057.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.Horsuke", lpFilePart=0x0) returned 0x91 [0057.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0057.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0057.213] GetFileType (hFile=0x228) returned 0x1 [0057.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0057.213] GetFileType (hFile=0x228) returned 0x1 [0057.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0057.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0057.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0057.677] GetFileType (hFile=0x15c) returned 0x1 [0057.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0057.677] GetFileType (hFile=0x15c) returned 0x1 [0057.677] ReadFile (in: hFile=0x15c, lpBuffer=0x240c770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240c770*, lpNumberOfBytesRead=0x2edb68*=0xa0, lpOverlapped=0x0) returned 1 [0057.678] ReadFile (in: hFile=0x15c, lpBuffer=0x240c770, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240c770*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0057.678] CloseHandle (hObject=0x15c) returned 1 [0057.678] WriteFile (in: hFile=0x228, lpBuffer=0x240abf0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x240abf0*, lpNumberOfBytesWritten=0x2eda38*=0xd0, lpOverlapped=0x0) returned 1 [0057.679] CloseHandle (hObject=0x228) returned 1 [0057.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0057.680] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0057.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0057.681] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", dwFileAttributes=0x80) returned 1 [0057.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.Horsuke", lpFilePart=0x0) returned 0x8f [0057.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0057.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0057.684] GetFileType (hFile=0x228) returned 0x1 [0057.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0057.684] GetFileType (hFile=0x228) returned 0x1 [0058.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0058.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0058.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0058.279] GetFileType (hFile=0x15c) returned 0x1 [0058.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.279] GetFileType (hFile=0x15c) returned 0x1 [0058.279] ReadFile (in: hFile=0x15c, lpBuffer=0x22f5450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22f5450*, lpNumberOfBytesRead=0x2edb68*=0x5c, lpOverlapped=0x0) returned 1 [0058.280] ReadFile (in: hFile=0x15c, lpBuffer=0x22f5450, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22f5450*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0058.280] CloseHandle (hObject=0x15c) returned 1 [0058.280] WriteFile (in: hFile=0x228, lpBuffer=0x22f38d8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x22f38d8*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0058.281] CloseHandle (hObject=0x228) returned 1 [0058.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0058.281] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0058.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0058.282] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", dwFileAttributes=0x80) returned 1 [0058.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.Horsuke", lpFilePart=0x0) returned 0x8d [0058.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0058.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.284] GetFileType (hFile=0x228) returned 0x1 [0058.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.284] GetFileType (hFile=0x228) returned 0x1 [0058.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0058.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0058.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0058.756] GetFileType (hFile=0x15c) returned 0x1 [0058.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.756] GetFileType (hFile=0x15c) returned 0x1 [0058.756] ReadFile (in: hFile=0x15c, lpBuffer=0x23de038, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23de038*, lpNumberOfBytesRead=0x2edb68*=0x5f, lpOverlapped=0x0) returned 1 [0058.757] ReadFile (in: hFile=0x15c, lpBuffer=0x23de038, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23de038*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0058.757] CloseHandle (hObject=0x15c) returned 1 [0058.757] WriteFile (in: hFile=0x228, lpBuffer=0x23dc4c8*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x23dc4c8*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0058.758] CloseHandle (hObject=0x228) returned 1 [0058.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0058.759] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0058.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0058.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86 [0058.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0058.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0058.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.772] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.773] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0058.774] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0058.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0058.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0058.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86 [0058.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0058.775] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0058.776] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.776] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.776] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.776] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.777] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.777] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.777] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.777] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.777] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.778] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.779] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.780] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0058.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0058.781] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0058.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0058.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0058.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0058.782] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.783] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.783] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.783] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.783] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0058.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0058.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.783] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.783] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.784] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.784] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.785] GetFileType (hFile=0x228) returned 0x1 [0058.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.785] GetFileType (hFile=0x228) returned 0x1 [0058.785] WriteFile (in: hFile=0x228, lpBuffer=0x23fddb0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x23fddb0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.786] CloseHandle (hObject=0x228) returned 1 [0058.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.786] GetFileType (hFile=0x228) returned 0x1 [0058.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.786] GetFileType (hFile=0x228) returned 0x1 [0058.786] WriteFile (in: hFile=0x228, lpBuffer=0x23fef08*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x23fef08*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.787] CloseHandle (hObject=0x228) returned 1 [0058.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.788] GetFileType (hFile=0x228) returned 0x1 [0058.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.788] GetFileType (hFile=0x228) returned 0x1 [0058.788] WriteFile (in: hFile=0x228, lpBuffer=0x2402c88*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2402c88*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.789] CloseHandle (hObject=0x228) returned 1 [0058.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.802] GetFileType (hFile=0x228) returned 0x1 [0058.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.802] GetFileType (hFile=0x228) returned 0x1 [0058.802] WriteFile (in: hFile=0x228, lpBuffer=0x24057d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x24057d8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.803] CloseHandle (hObject=0x228) returned 1 [0058.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0058.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0058.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.803] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.803] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.804] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0058.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0058.804] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.804] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.805] GetFileType (hFile=0x228) returned 0x1 [0058.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.805] GetFileType (hFile=0x228) returned 0x1 [0058.805] WriteFile (in: hFile=0x228, lpBuffer=0x24131d8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x24131d8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.806] CloseHandle (hObject=0x228) returned 1 [0058.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.807] GetFileType (hFile=0x228) returned 0x1 [0058.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.807] GetFileType (hFile=0x228) returned 0x1 [0058.807] WriteFile (in: hFile=0x228, lpBuffer=0x2414330*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2414330*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.808] CloseHandle (hObject=0x228) returned 1 [0058.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.808] GetFileType (hFile=0x228) returned 0x1 [0058.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.808] GetFileType (hFile=0x228) returned 0x1 [0058.808] WriteFile (in: hFile=0x228, lpBuffer=0x24180b0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x24180b0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.809] CloseHandle (hObject=0x228) returned 1 [0058.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.811] GetFileType (hFile=0x228) returned 0x1 [0058.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.811] GetFileType (hFile=0x228) returned 0x1 [0058.811] WriteFile (in: hFile=0x228, lpBuffer=0x241ac00*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x241ac00*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.812] CloseHandle (hObject=0x228) returned 1 [0058.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0058.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0058.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.813] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0058.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0058.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.814] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.815] GetFileType (hFile=0x228) returned 0x1 [0058.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.815] GetFileType (hFile=0x228) returned 0x1 [0058.815] WriteFile (in: hFile=0x228, lpBuffer=0x2428600*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2428600*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.816] CloseHandle (hObject=0x228) returned 1 [0058.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.817] GetFileType (hFile=0x228) returned 0x1 [0058.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.817] GetFileType (hFile=0x228) returned 0x1 [0058.817] WriteFile (in: hFile=0x228, lpBuffer=0x2429758*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2429758*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.818] CloseHandle (hObject=0x228) returned 1 [0058.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.818] GetFileType (hFile=0x228) returned 0x1 [0058.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.818] GetFileType (hFile=0x228) returned 0x1 [0058.818] WriteFile (in: hFile=0x228, lpBuffer=0x242d4d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x242d4d8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.819] CloseHandle (hObject=0x228) returned 1 [0058.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.840] GetFileType (hFile=0x228) returned 0x1 [0058.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.840] GetFileType (hFile=0x228) returned 0x1 [0058.840] WriteFile (in: hFile=0x228, lpBuffer=0x2430028*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2430028*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.841] CloseHandle (hObject=0x228) returned 1 [0058.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0058.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0058.841] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.842] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0058.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0058.842] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.843] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0058.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0058.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.870] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0058.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0058.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.870] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.876] GetFileType (hFile=0x228) returned 0x1 [0058.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.876] GetFileType (hFile=0x228) returned 0x1 [0058.876] WriteFile (in: hFile=0x228, lpBuffer=0x225ef00*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225ef00*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.877] CloseHandle (hObject=0x228) returned 1 [0058.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0058.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0058.877] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.878] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.878] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0058.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0058.878] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.879] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.879] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.879] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.879] GetFileType (hFile=0x228) returned 0x1 [0058.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.879] GetFileType (hFile=0x228) returned 0x1 [0058.879] WriteFile (in: hFile=0x228, lpBuffer=0x226c900*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x226c900*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.880] CloseHandle (hObject=0x228) returned 1 [0058.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.881] GetFileType (hFile=0x228) returned 0x1 [0058.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.881] GetFileType (hFile=0x228) returned 0x1 [0058.881] WriteFile (in: hFile=0x228, lpBuffer=0x226da58*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x226da58*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.882] CloseHandle (hObject=0x228) returned 1 [0058.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.882] GetFileType (hFile=0x228) returned 0x1 [0058.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.883] GetFileType (hFile=0x228) returned 0x1 [0058.883] WriteFile (in: hFile=0x228, lpBuffer=0x22717d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22717d8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.883] CloseHandle (hObject=0x228) returned 1 [0058.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.885] GetFileType (hFile=0x228) returned 0x1 [0058.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.885] GetFileType (hFile=0x228) returned 0x1 [0058.885] WriteFile (in: hFile=0x228, lpBuffer=0x2274328*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2274328*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.886] CloseHandle (hObject=0x228) returned 1 [0058.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0058.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0058.886] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.887] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.887] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.887] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0058.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0058.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.888] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.889] GetFileType (hFile=0x228) returned 0x1 [0058.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.889] GetFileType (hFile=0x228) returned 0x1 [0058.889] WriteFile (in: hFile=0x228, lpBuffer=0x2281d28*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2281d28*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.890] CloseHandle (hObject=0x228) returned 1 [0058.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.890] GetFileType (hFile=0x228) returned 0x1 [0058.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.891] GetFileType (hFile=0x228) returned 0x1 [0058.891] WriteFile (in: hFile=0x228, lpBuffer=0x2282e80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2282e80*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.891] CloseHandle (hObject=0x228) returned 1 [0058.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.892] GetFileType (hFile=0x228) returned 0x1 [0058.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.892] GetFileType (hFile=0x228) returned 0x1 [0058.892] WriteFile (in: hFile=0x228, lpBuffer=0x2286c00*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2286c00*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.893] CloseHandle (hObject=0x228) returned 1 [0058.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.895] GetFileType (hFile=0x228) returned 0x1 [0058.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.895] GetFileType (hFile=0x228) returned 0x1 [0058.895] WriteFile (in: hFile=0x228, lpBuffer=0x2289750*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2289750*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.895] CloseHandle (hObject=0x228) returned 1 [0058.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0058.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0058.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.896] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0058.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0058.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.897] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0058.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.897] GetFileType (hFile=0x228) returned 0x1 [0058.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.898] GetFileType (hFile=0x228) returned 0x1 [0058.898] WriteFile (in: hFile=0x228, lpBuffer=0x2297230*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2297230*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.899] CloseHandle (hObject=0x228) returned 1 [0058.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.png", lpFilePart=0x0) returned 0x95 [0058.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.899] GetFileType (hFile=0x228) returned 0x1 [0058.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.899] GetFileType (hFile=0x228) returned 0x1 [0058.899] WriteFile (in: hFile=0x228, lpBuffer=0x2298390*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2298390*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.900] CloseHandle (hObject=0x228) returned 1 [0058.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0058.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.901] GetFileType (hFile=0x228) returned 0x1 [0058.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.901] GetFileType (hFile=0x228) returned 0x1 [0058.901] WriteFile (in: hFile=0x228, lpBuffer=0x229c128*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x229c128*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.902] CloseHandle (hObject=0x228) returned 1 [0058.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0058.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.908] GetFileType (hFile=0x228) returned 0x1 [0058.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.908] GetFileType (hFile=0x228) returned 0x1 [0058.908] WriteFile (in: hFile=0x228, lpBuffer=0x229ec88*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229ec88*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.909] CloseHandle (hObject=0x228) returned 1 [0058.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0058.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0058.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.910] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0058.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0058.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.911] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.911] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.911] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.911] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0058.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.911] GetFileType (hFile=0x228) returned 0x1 [0058.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.911] GetFileType (hFile=0x228) returned 0x1 [0058.912] WriteFile (in: hFile=0x228, lpBuffer=0x22ac768*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22ac768*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.913] CloseHandle (hObject=0x228) returned 1 [0058.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.png", lpFilePart=0x0) returned 0x95 [0058.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.913] GetFileType (hFile=0x228) returned 0x1 [0058.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.913] GetFileType (hFile=0x228) returned 0x1 [0058.913] WriteFile (in: hFile=0x228, lpBuffer=0x22ad8c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22ad8c8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.914] CloseHandle (hObject=0x228) returned 1 [0058.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0058.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.915] GetFileType (hFile=0x228) returned 0x1 [0058.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.915] GetFileType (hFile=0x228) returned 0x1 [0058.915] WriteFile (in: hFile=0x228, lpBuffer=0x22b1660*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22b1660*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.916] CloseHandle (hObject=0x228) returned 1 [0058.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0058.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.925] GetFileType (hFile=0x228) returned 0x1 [0058.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.925] GetFileType (hFile=0x228) returned 0x1 [0058.925] WriteFile (in: hFile=0x228, lpBuffer=0x22b41c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b41c0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.926] CloseHandle (hObject=0x228) returned 1 [0058.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0058.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0058.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.927] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.927] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.927] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.927] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0058.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0058.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.928] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.928] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.928] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.928] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.929] GetFileType (hFile=0x228) returned 0x1 [0058.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.929] GetFileType (hFile=0x228) returned 0x1 [0058.929] WriteFile (in: hFile=0x228, lpBuffer=0x22c1bc0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22c1bc0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.930] CloseHandle (hObject=0x228) returned 1 [0058.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.930] GetFileType (hFile=0x228) returned 0x1 [0058.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.930] GetFileType (hFile=0x228) returned 0x1 [0058.930] WriteFile (in: hFile=0x228, lpBuffer=0x22c2d18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22c2d18*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.931] CloseHandle (hObject=0x228) returned 1 [0058.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.932] GetFileType (hFile=0x228) returned 0x1 [0058.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.932] GetFileType (hFile=0x228) returned 0x1 [0058.932] WriteFile (in: hFile=0x228, lpBuffer=0x22c6a98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22c6a98*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0058.933] CloseHandle (hObject=0x228) returned 1 [0058.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.948] GetFileType (hFile=0x228) returned 0x1 [0058.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.948] GetFileType (hFile=0x228) returned 0x1 [0058.948] WriteFile (in: hFile=0x228, lpBuffer=0x22c95e8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22c95e8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0058.949] CloseHandle (hObject=0x228) returned 1 [0058.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0058.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0058.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.950] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0058.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0058.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.950] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0058.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.951] GetFileType (hFile=0x228) returned 0x1 [0058.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.951] GetFileType (hFile=0x228) returned 0x1 [0058.952] WriteFile (in: hFile=0x228, lpBuffer=0x22d70e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22d70e8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0058.952] CloseHandle (hObject=0x228) returned 1 [0058.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.png", lpFilePart=0x0) returned 0x96 [0058.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.955] GetFileType (hFile=0x228) returned 0x1 [0058.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.955] GetFileType (hFile=0x228) returned 0x1 [0058.955] WriteFile (in: hFile=0x228, lpBuffer=0x22d8248*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22d8248*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0058.956] CloseHandle (hObject=0x228) returned 1 [0058.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0058.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.957] GetFileType (hFile=0x228) returned 0x1 [0058.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0058.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0058.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0058.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.971] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0058.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0058.971] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.972] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0058.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0058.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.984] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0058.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0058.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.984] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0058.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x92 [0058.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0058.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0058.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0058.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0058.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.994] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0058.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0058.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0058.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0058.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0058.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0058.995] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0058.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0058.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0058.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0058.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x93 [0058.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0058.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0058.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0058.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0058.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0058.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0058.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0058.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0058.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0059.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0059.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.008] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0059.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0059.009] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.009] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0059.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0059.040] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.041] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.041] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0059.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0059.041] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.042] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.042] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.042] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.042] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0059.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0059.048] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.048] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0059.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0059.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.049] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0059.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0059.062] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.063] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.064] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.064] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.064] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0059.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0059.064] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.064] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.064] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.064] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.064] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0059.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0059.076] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.077] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0059.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0059.077] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.078] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0059.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0059.105] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.106] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0059.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0059.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.107] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0059.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0059.113] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.114] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0059.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0059.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.114] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0059.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0059.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.123] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0059.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0059.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.123] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0059.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0059.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.133] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0059.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0059.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.134] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0059.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0059.140] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.140] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.140] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.140] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.141] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0059.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0059.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.141] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0059.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0059.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.148] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0059.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0059.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.148] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0059.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0059.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.162] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0059.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0059.162] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.163] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0059.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0059.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.169] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0059.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0059.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.169] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0059.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0059.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.177] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0059.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0059.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.177] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0059.181] WriteFile (in: hFile=0x228, lpBuffer=0x22409a8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22409a8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0059.182] CloseHandle (hObject=0x228) returned 1 [0059.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x92 [0059.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.183] GetFileType (hFile=0x228) returned 0x1 [0059.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.183] GetFileType (hFile=0x228) returned 0x1 [0059.183] WriteFile (in: hFile=0x228, lpBuffer=0x2241b00*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2241b00*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0059.184] CloseHandle (hObject=0x228) returned 1 [0059.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0059.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.185] GetFileType (hFile=0x228) returned 0x1 [0059.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.185] GetFileType (hFile=0x228) returned 0x1 [0059.185] WriteFile (in: hFile=0x228, lpBuffer=0x2245880*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2245880*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0059.186] CloseHandle (hObject=0x228) returned 1 [0059.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0059.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.200] GetFileType (hFile=0x228) returned 0x1 [0059.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.200] GetFileType (hFile=0x228) returned 0x1 [0059.200] WriteFile (in: hFile=0x228, lpBuffer=0x22483d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22483d0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0059.201] CloseHandle (hObject=0x228) returned 1 [0059.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0059.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0059.201] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.201] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.202] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0059.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0059.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.203] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.203] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0059.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.205] GetFileType (hFile=0x228) returned 0x1 [0059.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.205] GetFileType (hFile=0x228) returned 0x1 [0059.206] WriteFile (in: hFile=0x228, lpBuffer=0x2255eb0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2255eb0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0059.207] CloseHandle (hObject=0x228) returned 1 [0059.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.png", lpFilePart=0x0) returned 0x95 [0059.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.207] GetFileType (hFile=0x228) returned 0x1 [0059.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.207] GetFileType (hFile=0x228) returned 0x1 [0059.207] WriteFile (in: hFile=0x228, lpBuffer=0x2257010*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2257010*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0059.208] CloseHandle (hObject=0x228) returned 1 [0059.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0059.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.209] GetFileType (hFile=0x228) returned 0x1 [0059.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.209] GetFileType (hFile=0x228) returned 0x1 [0059.209] WriteFile (in: hFile=0x228, lpBuffer=0x225ada8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x225ada8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0059.210] CloseHandle (hObject=0x228) returned 1 [0059.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0059.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.232] GetFileType (hFile=0x228) returned 0x1 [0059.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.232] GetFileType (hFile=0x228) returned 0x1 [0059.232] WriteFile (in: hFile=0x228, lpBuffer=0x225d908*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225d908*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0059.233] CloseHandle (hObject=0x228) returned 1 [0059.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0059.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0059.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.235] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.235] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0059.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0059.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.235] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.236] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0059.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.237] GetFileType (hFile=0x228) returned 0x1 [0059.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.237] GetFileType (hFile=0x228) returned 0x1 [0059.237] WriteFile (in: hFile=0x228, lpBuffer=0x226b3e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x226b3e8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0059.238] CloseHandle (hObject=0x228) returned 1 [0059.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.png", lpFilePart=0x0) returned 0x95 [0059.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.239] GetFileType (hFile=0x228) returned 0x1 [0059.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.239] GetFileType (hFile=0x228) returned 0x1 [0059.239] WriteFile (in: hFile=0x228, lpBuffer=0x226c548*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x226c548*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0059.240] CloseHandle (hObject=0x228) returned 1 [0059.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0059.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.240] GetFileType (hFile=0x228) returned 0x1 [0059.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.240] GetFileType (hFile=0x228) returned 0x1 [0059.240] WriteFile (in: hFile=0x228, lpBuffer=0x22702e0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22702e0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0059.241] CloseHandle (hObject=0x228) returned 1 [0059.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0059.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.306] GetFileType (hFile=0x228) returned 0x1 [0059.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.306] GetFileType (hFile=0x228) returned 0x1 [0059.306] WriteFile (in: hFile=0x228, lpBuffer=0x2272e40*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2272e40*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0059.307] CloseHandle (hObject=0x228) returned 1 [0059.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0059.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0059.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.308] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0059.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.309] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.309] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.309] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.309] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.310] GetFileType (hFile=0x228) returned 0x1 [0059.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.310] GetFileType (hFile=0x228) returned 0x1 [0059.310] WriteFile (in: hFile=0x228, lpBuffer=0x2280840*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2280840*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0059.311] CloseHandle (hObject=0x228) returned 1 [0059.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.312] GetFileType (hFile=0x228) returned 0x1 [0059.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.312] GetFileType (hFile=0x228) returned 0x1 [0059.312] WriteFile (in: hFile=0x228, lpBuffer=0x2281998*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2281998*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0059.313] CloseHandle (hObject=0x228) returned 1 [0059.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.314] GetFileType (hFile=0x228) returned 0x1 [0059.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.314] GetFileType (hFile=0x228) returned 0x1 [0059.314] WriteFile (in: hFile=0x228, lpBuffer=0x2285718*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2285718*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0059.314] CloseHandle (hObject=0x228) returned 1 [0059.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.330] GetFileType (hFile=0x228) returned 0x1 [0059.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.330] GetFileType (hFile=0x228) returned 0x1 [0059.331] WriteFile (in: hFile=0x228, lpBuffer=0x2288268*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2288268*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0059.331] CloseHandle (hObject=0x228) returned 1 [0059.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.333] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.333] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.334] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.334] GetFileType (hFile=0x228) returned 0x1 [0059.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.334] GetFileType (hFile=0x228) returned 0x1 [0059.334] WriteFile (in: hFile=0x228, lpBuffer=0x2295c68*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2295c68*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0059.335] CloseHandle (hObject=0x228) returned 1 [0059.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.336] GetFileType (hFile=0x228) returned 0x1 [0059.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.336] GetFileType (hFile=0x228) returned 0x1 [0059.336] WriteFile (in: hFile=0x228, lpBuffer=0x2296dc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2296dc0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0059.337] CloseHandle (hObject=0x228) returned 1 [0059.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.337] GetFileType (hFile=0x228) returned 0x1 [0059.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.338] GetFileType (hFile=0x228) returned 0x1 [0059.338] WriteFile (in: hFile=0x228, lpBuffer=0x229ab40*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x229ab40*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0059.338] CloseHandle (hObject=0x228) returned 1 [0059.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.345] GetFileType (hFile=0x228) returned 0x1 [0059.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.345] GetFileType (hFile=0x228) returned 0x1 [0059.346] WriteFile (in: hFile=0x228, lpBuffer=0x229d690*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229d690*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0059.346] CloseHandle (hObject=0x228) returned 1 [0059.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.347] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.348] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.349] GetFileType (hFile=0x228) returned 0x1 [0059.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.349] GetFileType (hFile=0x228) returned 0x1 [0059.349] WriteFile (in: hFile=0x228, lpBuffer=0x22ab090*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22ab090*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0059.350] CloseHandle (hObject=0x228) returned 1 [0059.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.351] GetFileType (hFile=0x228) returned 0x1 [0059.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.351] GetFileType (hFile=0x228) returned 0x1 [0059.351] WriteFile (in: hFile=0x228, lpBuffer=0x22ac1e8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22ac1e8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0059.352] CloseHandle (hObject=0x228) returned 1 [0059.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.353] GetFileType (hFile=0x228) returned 0x1 [0059.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.353] GetFileType (hFile=0x228) returned 0x1 [0059.353] WriteFile (in: hFile=0x228, lpBuffer=0x22aff68*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22aff68*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0059.353] CloseHandle (hObject=0x228) returned 1 [0059.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.357] GetFileType (hFile=0x228) returned 0x1 [0059.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.358] GetFileType (hFile=0x228) returned 0x1 [0059.358] WriteFile (in: hFile=0x228, lpBuffer=0x22b2ab8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b2ab8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0059.359] CloseHandle (hObject=0x228) returned 1 [0059.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.360] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.361] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.361] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.361] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.361] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.361] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.373] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.374] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.387] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.387] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.388] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.388] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.388] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.388] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.388] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.409] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.409] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.410] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.421] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.421] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.422] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.422] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.422] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.422] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.422] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.422] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.428] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.429] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.429] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.429] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.431] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.445] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.446] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.446] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.447] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.458] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.459] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.459] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.459] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.477] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0059.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0059.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0059.478] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0059.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0059.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0059.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0059.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0059.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0059.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0059.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0059.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0059.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0059.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0059.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0059.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0059.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0059.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0059.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0059.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0059.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0059.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0059.489] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0059.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0059.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0059.490] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0059.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0059.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0059.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0059.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0059.490] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0059.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0059.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0059.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0059.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0059.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0059.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0059.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0059.494] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0059.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0059.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0059.496] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0059.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0059.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0059.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0059.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0059.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0059.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0059.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0059.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0059.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0059.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0059.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0059.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0059.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0059.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0059.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0059.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0059.509] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0059.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0059.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0059.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0059.510] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0059.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0059.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0059.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0059.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0059.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0059.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0059.510] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0059.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0059.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0059.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.523] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0059.523] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0059.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0059.524] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0059.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0059.525] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0059.526] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", dwFileAttributes=0x80) returned 1 [0059.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0059.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0059.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0059.986] GetFileType (hFile=0x15c) returned 0x1 [0059.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.987] GetFileType (hFile=0x15c) returned 0x1 [0059.987] ReadFile (in: hFile=0x15c, lpBuffer=0x22ae7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22ae7f0*, lpNumberOfBytesRead=0x2edb68*=0xc8d, lpOverlapped=0x0) returned 1 [0059.991] ReadFile (in: hFile=0x15c, lpBuffer=0x22ae465, nNumberOfBytesToRead=0x373, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22ae465*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0059.991] ReadFile (in: hFile=0x15c, lpBuffer=0x22ae7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22ae7f0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0059.991] CloseHandle (hObject=0x15c) returned 1 [0059.991] WriteFile (in: hFile=0x228, lpBuffer=0x22acc68*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x22acc68*, lpNumberOfBytesWritten=0x2eda38*=0xcb0, lpOverlapped=0x0) returned 1 [0059.992] CloseHandle (hObject=0x228) returned 1 [0059.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0059.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0059.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0059.994] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", dwFileAttributes=0x80) returned 1 [0059.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.Horsuke", lpFilePart=0x0) returned 0x91 [0059.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0059.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0059.995] GetFileType (hFile=0x228) returned 0x1 [0059.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0059.996] GetFileType (hFile=0x228) returned 0x1 [0060.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0060.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0060.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0060.563] GetFileType (hFile=0x15c) returned 0x1 [0060.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0060.563] GetFileType (hFile=0x15c) returned 0x1 [0060.563] ReadFile (in: hFile=0x15c, lpBuffer=0x23979a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23979a0*, lpNumberOfBytesRead=0x2edb68*=0x8f, lpOverlapped=0x0) returned 1 [0060.564] ReadFile (in: hFile=0x15c, lpBuffer=0x23979a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23979a0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0060.564] CloseHandle (hObject=0x15c) returned 1 [0060.564] WriteFile (in: hFile=0x228, lpBuffer=0x2395e20*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2395e20*, lpNumberOfBytesWritten=0x2eda38*=0xb0, lpOverlapped=0x0) returned 1 [0060.565] CloseHandle (hObject=0x228) returned 1 [0060.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0060.566] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0060.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0060.567] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", dwFileAttributes=0x80) returned 1 [0060.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.Horsuke", lpFilePart=0x0) returned 0x8f [0060.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0060.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0060.568] GetFileType (hFile=0x228) returned 0x1 [0060.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0060.568] GetFileType (hFile=0x228) returned 0x1 [0061.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0061.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0061.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0061.020] GetFileType (hFile=0x15c) returned 0x1 [0061.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.020] GetFileType (hFile=0x15c) returned 0x1 [0061.020] ReadFile (in: hFile=0x15c, lpBuffer=0x227fd10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x227fd10*, lpNumberOfBytesRead=0x2edb68*=0x5c, lpOverlapped=0x0) returned 1 [0061.021] ReadFile (in: hFile=0x15c, lpBuffer=0x227fd10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x227fd10*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0061.021] CloseHandle (hObject=0x15c) returned 1 [0061.021] WriteFile (in: hFile=0x228, lpBuffer=0x227e198*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x227e198*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0061.022] CloseHandle (hObject=0x228) returned 1 [0061.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html", lpFilePart=0x0) returned 0x87 [0061.023] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1 [0061.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0061.024] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", dwFileAttributes=0x80) returned 1 [0061.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.Horsuke", lpFilePart=0x0) returned 0x8d [0061.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0061.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.025] GetFileType (hFile=0x228) returned 0x1 [0061.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.025] GetFileType (hFile=0x228) returned 0x1 [0061.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0061.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0061.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0061.479] GetFileType (hFile=0x15c) returned 0x1 [0061.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.479] GetFileType (hFile=0x15c) returned 0x1 [0061.479] ReadFile (in: hFile=0x15c, lpBuffer=0x2366988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2366988*, lpNumberOfBytesRead=0x2edb68*=0x5b, lpOverlapped=0x0) returned 1 [0061.480] ReadFile (in: hFile=0x15c, lpBuffer=0x2366988, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2366988*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0061.480] CloseHandle (hObject=0x15c) returned 1 [0061.480] WriteFile (in: hFile=0x228, lpBuffer=0x2364e18*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2364e18*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0061.481] CloseHandle (hObject=0x228) returned 1 [0061.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js", lpFilePart=0x0) returned 0x85 [0061.482] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1 [0061.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0061.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86 [0061.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0061.483] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0061.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.489] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.490] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0061.492] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0061.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0061.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0061.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales", lpFilePart=0x0) returned 0x86 [0061.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0061.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0061.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0061.498] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0061.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0061.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0061.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0061.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.500] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0061.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0061.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.501] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.502] GetFileType (hFile=0x228) returned 0x1 [0061.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.502] GetFileType (hFile=0x228) returned 0x1 [0061.502] WriteFile (in: hFile=0x228, lpBuffer=0x2386700*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2386700*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.503] CloseHandle (hObject=0x228) returned 1 [0061.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.504] GetFileType (hFile=0x228) returned 0x1 [0061.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.504] GetFileType (hFile=0x228) returned 0x1 [0061.504] WriteFile (in: hFile=0x228, lpBuffer=0x2387858*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2387858*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.505] CloseHandle (hObject=0x228) returned 1 [0061.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.506] GetFileType (hFile=0x228) returned 0x1 [0061.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.506] GetFileType (hFile=0x228) returned 0x1 [0061.506] WriteFile (in: hFile=0x228, lpBuffer=0x238b5d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x238b5d8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.507] CloseHandle (hObject=0x228) returned 1 [0061.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.522] GetFileType (hFile=0x228) returned 0x1 [0061.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.522] GetFileType (hFile=0x228) returned 0x1 [0061.522] WriteFile (in: hFile=0x228, lpBuffer=0x238e128*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x238e128*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.523] CloseHandle (hObject=0x228) returned 1 [0061.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0061.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0061.523] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.524] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.524] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.524] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.524] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0061.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0061.525] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.525] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.525] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.527] GetFileType (hFile=0x228) returned 0x1 [0061.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.527] GetFileType (hFile=0x228) returned 0x1 [0061.527] WriteFile (in: hFile=0x228, lpBuffer=0x239bb28*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x239bb28*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.528] CloseHandle (hObject=0x228) returned 1 [0061.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.532] GetFileType (hFile=0x228) returned 0x1 [0061.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.532] GetFileType (hFile=0x228) returned 0x1 [0061.532] WriteFile (in: hFile=0x228, lpBuffer=0x239cc80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x239cc80*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.533] CloseHandle (hObject=0x228) returned 1 [0061.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.534] GetFileType (hFile=0x228) returned 0x1 [0061.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.534] GetFileType (hFile=0x228) returned 0x1 [0061.534] WriteFile (in: hFile=0x228, lpBuffer=0x23a0a00*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x23a0a00*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.535] CloseHandle (hObject=0x228) returned 1 [0061.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.542] GetFileType (hFile=0x228) returned 0x1 [0061.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.542] GetFileType (hFile=0x228) returned 0x1 [0061.542] WriteFile (in: hFile=0x228, lpBuffer=0x23a3550*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x23a3550*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.543] CloseHandle (hObject=0x228) returned 1 [0061.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0061.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0061.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.544] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.544] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.544] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.544] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0061.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0061.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.545] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.545] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.545] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.545] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.546] GetFileType (hFile=0x228) returned 0x1 [0061.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.546] GetFileType (hFile=0x228) returned 0x1 [0061.546] WriteFile (in: hFile=0x228, lpBuffer=0x23b0f50*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x23b0f50*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.547] CloseHandle (hObject=0x228) returned 1 [0061.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.547] GetFileType (hFile=0x228) returned 0x1 [0061.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.547] GetFileType (hFile=0x228) returned 0x1 [0061.547] WriteFile (in: hFile=0x228, lpBuffer=0x23b20a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x23b20a8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.548] CloseHandle (hObject=0x228) returned 1 [0061.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.549] GetFileType (hFile=0x228) returned 0x1 [0061.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.549] GetFileType (hFile=0x228) returned 0x1 [0061.549] WriteFile (in: hFile=0x228, lpBuffer=0x23b5e28*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x23b5e28*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.549] CloseHandle (hObject=0x228) returned 1 [0061.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.551] GetFileType (hFile=0x228) returned 0x1 [0061.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.551] GetFileType (hFile=0x228) returned 0x1 [0061.551] WriteFile (in: hFile=0x228, lpBuffer=0x23b8978*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x23b8978*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.552] CloseHandle (hObject=0x228) returned 1 [0061.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0061.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0061.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.553] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0061.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0061.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.554] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0061.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0061.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.562] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0061.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0061.563] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.563] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.563] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.564] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0061.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0061.585] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.585] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.585] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.586] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0061.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0061.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.586] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0061.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0061.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0061.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0061.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0061.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0061.620] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.620] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.620] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.621] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.621] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0061.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0061.621] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.621] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.621] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.621] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.621] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0061.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.png", lpFilePart=0x0) returned 0x95 [0061.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0061.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0061.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0061.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0061.642] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.643] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.643] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.643] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.643] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0061.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0061.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.643] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.643] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.643] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.643] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0061.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.png", lpFilePart=0x0) returned 0x95 [0061.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0061.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.648] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0061.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0061.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0061.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0061.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0061.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.657] WriteFile (in: hFile=0x228, lpBuffer=0x2248e68*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2248e68*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.657] CloseHandle (hObject=0x228) returned 1 [0061.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.658] GetFileType (hFile=0x228) returned 0x1 [0061.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.658] GetFileType (hFile=0x228) returned 0x1 [0061.658] WriteFile (in: hFile=0x228, lpBuffer=0x2249fc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2249fc0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.659] CloseHandle (hObject=0x228) returned 1 [0061.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.660] GetFileType (hFile=0x228) returned 0x1 [0061.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.660] GetFileType (hFile=0x228) returned 0x1 [0061.660] WriteFile (in: hFile=0x228, lpBuffer=0x224dd40*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224dd40*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.660] CloseHandle (hObject=0x228) returned 1 [0061.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.665] GetFileType (hFile=0x228) returned 0x1 [0061.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.665] GetFileType (hFile=0x228) returned 0x1 [0061.665] WriteFile (in: hFile=0x228, lpBuffer=0x2250890*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2250890*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.665] CloseHandle (hObject=0x228) returned 1 [0061.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0061.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0061.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.666] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.666] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.666] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.666] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0061.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0061.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.667] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.667] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.667] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.667] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0061.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.668] GetFileType (hFile=0x228) returned 0x1 [0061.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.668] GetFileType (hFile=0x228) returned 0x1 [0061.668] WriteFile (in: hFile=0x228, lpBuffer=0x225e390*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225e390*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.669] CloseHandle (hObject=0x228) returned 1 [0061.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.png", lpFilePart=0x0) returned 0x96 [0061.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.670] GetFileType (hFile=0x228) returned 0x1 [0061.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.670] GetFileType (hFile=0x228) returned 0x1 [0061.670] WriteFile (in: hFile=0x228, lpBuffer=0x225f4f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x225f4f0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.671] CloseHandle (hObject=0x228) returned 1 [0061.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0061.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.671] GetFileType (hFile=0x228) returned 0x1 [0061.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.671] GetFileType (hFile=0x228) returned 0x1 [0061.671] WriteFile (in: hFile=0x228, lpBuffer=0x2263288*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2263288*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.672] CloseHandle (hObject=0x228) returned 1 [0061.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0061.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.676] GetFileType (hFile=0x228) returned 0x1 [0061.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.676] GetFileType (hFile=0x228) returned 0x1 [0061.676] WriteFile (in: hFile=0x228, lpBuffer=0x2265de8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2265de8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.677] CloseHandle (hObject=0x228) returned 1 [0061.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0061.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0061.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.678] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.678] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.678] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.678] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0061.678] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0061.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.679] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.679] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.679] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.679] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.679] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.680] GetFileType (hFile=0x228) returned 0x1 [0061.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.680] GetFileType (hFile=0x228) returned 0x1 [0061.680] WriteFile (in: hFile=0x228, lpBuffer=0x22737e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22737e8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.681] CloseHandle (hObject=0x228) returned 1 [0061.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.681] GetFileType (hFile=0x228) returned 0x1 [0061.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.681] GetFileType (hFile=0x228) returned 0x1 [0061.682] WriteFile (in: hFile=0x228, lpBuffer=0x2274940*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2274940*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.682] CloseHandle (hObject=0x228) returned 1 [0061.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.683] GetFileType (hFile=0x228) returned 0x1 [0061.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.683] GetFileType (hFile=0x228) returned 0x1 [0061.683] WriteFile (in: hFile=0x228, lpBuffer=0x22786c0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22786c0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.684] CloseHandle (hObject=0x228) returned 1 [0061.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.688] GetFileType (hFile=0x228) returned 0x1 [0061.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.688] GetFileType (hFile=0x228) returned 0x1 [0061.688] WriteFile (in: hFile=0x228, lpBuffer=0x227b210*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227b210*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.689] CloseHandle (hObject=0x228) returned 1 [0061.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0061.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0061.689] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.690] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.690] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.690] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.690] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0061.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0061.690] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.690] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.691] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.691] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.691] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.691] GetFileType (hFile=0x228) returned 0x1 [0061.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.692] GetFileType (hFile=0x228) returned 0x1 [0061.692] WriteFile (in: hFile=0x228, lpBuffer=0x2288c10*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2288c10*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.693] CloseHandle (hObject=0x228) returned 1 [0061.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.693] GetFileType (hFile=0x228) returned 0x1 [0061.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.693] GetFileType (hFile=0x228) returned 0x1 [0061.693] WriteFile (in: hFile=0x228, lpBuffer=0x2289d68*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2289d68*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.694] CloseHandle (hObject=0x228) returned 1 [0061.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.695] GetFileType (hFile=0x228) returned 0x1 [0061.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.695] GetFileType (hFile=0x228) returned 0x1 [0061.695] WriteFile (in: hFile=0x228, lpBuffer=0x228dae8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x228dae8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.696] CloseHandle (hObject=0x228) returned 1 [0061.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.697] GetFileType (hFile=0x228) returned 0x1 [0061.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.697] GetFileType (hFile=0x228) returned 0x1 [0061.697] WriteFile (in: hFile=0x228, lpBuffer=0x2290638*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2290638*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.698] CloseHandle (hObject=0x228) returned 1 [0061.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0061.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0061.699] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.699] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.700] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0061.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0061.700] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.700] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.700] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0061.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.701] GetFileType (hFile=0x228) returned 0x1 [0061.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.701] GetFileType (hFile=0x228) returned 0x1 [0061.701] WriteFile (in: hFile=0x228, lpBuffer=0x229e0c8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229e0c8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.702] CloseHandle (hObject=0x228) returned 1 [0061.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x93 [0061.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.703] GetFileType (hFile=0x228) returned 0x1 [0061.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.703] GetFileType (hFile=0x228) returned 0x1 [0061.703] WriteFile (in: hFile=0x228, lpBuffer=0x229f220*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x229f220*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.704] CloseHandle (hObject=0x228) returned 1 [0061.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0061.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.704] GetFileType (hFile=0x228) returned 0x1 [0061.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.704] GetFileType (hFile=0x228) returned 0x1 [0061.704] WriteFile (in: hFile=0x228, lpBuffer=0x22a2fa0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22a2fa0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.705] CloseHandle (hObject=0x228) returned 1 [0061.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0061.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.707] GetFileType (hFile=0x228) returned 0x1 [0061.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.707] GetFileType (hFile=0x228) returned 0x1 [0061.707] WriteFile (in: hFile=0x228, lpBuffer=0x22a5af0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a5af0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.708] CloseHandle (hObject=0x228) returned 1 [0061.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0061.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0061.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.709] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.709] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.709] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.709] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.709] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0061.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0061.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.710] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.710] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.710] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.710] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.711] GetFileType (hFile=0x228) returned 0x1 [0061.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.711] GetFileType (hFile=0x228) returned 0x1 [0061.712] WriteFile (in: hFile=0x228, lpBuffer=0x22b34f0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b34f0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.713] CloseHandle (hObject=0x228) returned 1 [0061.713] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.714] GetFileType (hFile=0x228) returned 0x1 [0061.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.714] GetFileType (hFile=0x228) returned 0x1 [0061.714] WriteFile (in: hFile=0x228, lpBuffer=0x22b4648*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22b4648*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.714] CloseHandle (hObject=0x228) returned 1 [0061.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.715] GetFileType (hFile=0x228) returned 0x1 [0061.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.715] GetFileType (hFile=0x228) returned 0x1 [0061.715] WriteFile (in: hFile=0x228, lpBuffer=0x22b83c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22b83c8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.716] CloseHandle (hObject=0x228) returned 1 [0061.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.718] GetFileType (hFile=0x228) returned 0x1 [0061.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.718] GetFileType (hFile=0x228) returned 0x1 [0061.718] WriteFile (in: hFile=0x228, lpBuffer=0x22baf18*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22baf18*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.719] CloseHandle (hObject=0x228) returned 1 [0061.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0061.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0061.719] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.720] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0061.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0061.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.721] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0061.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0061.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.736] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.736] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.736] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.736] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0061.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0061.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.737] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0061.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0061.744] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.744] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.745] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.745] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.745] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0061.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0061.745] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.745] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.745] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.745] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.746] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0061.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0061.751] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.752] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.752] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.752] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0061.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0061.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.752] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.752] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.752] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.752] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0061.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0061.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.761] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.761] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.761] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0061.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0061.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.761] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.761] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.761] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.761] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0061.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0061.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.768] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0061.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0061.768] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.768] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0061.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0061.784] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.785] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.785] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.786] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0061.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0061.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.787] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0061.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0061.794] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.794] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.794] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.794] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.794] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0061.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0061.795] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.795] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0061.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0061.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.802] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.802] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.802] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.802] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0061.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0061.802] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.803] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.803] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.803] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.803] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0061.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0061.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.816] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0061.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0061.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.817] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0061.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0061.827] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.827] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.827] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.828] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.828] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0061.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0061.828] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.828] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.828] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.828] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.828] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0061.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0061.843] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.843] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.843] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0061.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0061.844] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.844] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.844] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.844] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.844] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0061.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0061.852] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.853] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0061.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0061.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.853] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.853] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0061.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0061.865] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.866] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0061.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0061.866] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.866] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0061.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.png", lpFilePart=0x0) returned 0x95 [0061.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0061.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0061.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0061.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0061.880] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.881] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.881] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.881] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.881] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0061.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0061.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.882] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0061.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.png", lpFilePart=0x0) returned 0x95 [0061.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0061.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0061.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0061.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0061.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.891] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.891] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.891] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.891] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0061.891] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.892] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.892] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.892] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.892] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.898] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.899] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.899] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.899] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.904] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.904] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.904] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.905] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.905] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.905] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.905] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.905] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.905] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.905] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.915] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.916] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.916] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.916] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.916] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.916] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.916] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.916] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.916] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.916] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.920] WriteFile (in: hFile=0x228, lpBuffer=0x2247548*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2247548*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.921] CloseHandle (hObject=0x228) returned 1 [0061.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.921] GetFileType (hFile=0x228) returned 0x1 [0061.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.921] GetFileType (hFile=0x228) returned 0x1 [0061.921] WriteFile (in: hFile=0x228, lpBuffer=0x22486a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22486a0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.922] CloseHandle (hObject=0x228) returned 1 [0061.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.923] GetFileType (hFile=0x228) returned 0x1 [0061.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.923] GetFileType (hFile=0x228) returned 0x1 [0061.923] WriteFile (in: hFile=0x228, lpBuffer=0x224c420*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224c420*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.924] CloseHandle (hObject=0x228) returned 1 [0061.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.927] GetFileType (hFile=0x228) returned 0x1 [0061.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.927] GetFileType (hFile=0x228) returned 0x1 [0061.927] WriteFile (in: hFile=0x228, lpBuffer=0x224ef70*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224ef70*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.928] CloseHandle (hObject=0x228) returned 1 [0061.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0061.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0061.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.929] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0061.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0061.930] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.930] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.933] GetFileType (hFile=0x228) returned 0x1 [0061.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.933] GetFileType (hFile=0x228) returned 0x1 [0061.933] WriteFile (in: hFile=0x228, lpBuffer=0x225c970*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225c970*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.934] CloseHandle (hObject=0x228) returned 1 [0061.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.935] GetFileType (hFile=0x228) returned 0x1 [0061.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.935] GetFileType (hFile=0x228) returned 0x1 [0061.935] WriteFile (in: hFile=0x228, lpBuffer=0x225dac8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x225dac8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.936] CloseHandle (hObject=0x228) returned 1 [0061.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.936] GetFileType (hFile=0x228) returned 0x1 [0061.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.936] GetFileType (hFile=0x228) returned 0x1 [0061.936] WriteFile (in: hFile=0x228, lpBuffer=0x2261848*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2261848*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.937] CloseHandle (hObject=0x228) returned 1 [0061.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.940] GetFileType (hFile=0x228) returned 0x1 [0061.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.940] GetFileType (hFile=0x228) returned 0x1 [0061.940] WriteFile (in: hFile=0x228, lpBuffer=0x2264398*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2264398*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.941] CloseHandle (hObject=0x228) returned 1 [0061.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x89 [0061.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a [0061.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.943] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv", lpFilePart=0x0) returned 0x89 [0061.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a [0061.943] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.943] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.945] GetFileType (hFile=0x228) returned 0x1 [0061.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.945] GetFileType (hFile=0x228) returned 0x1 [0061.945] WriteFile (in: hFile=0x228, lpBuffer=0x2271d98*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2271d98*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.946] CloseHandle (hObject=0x228) returned 1 [0061.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.947] GetFileType (hFile=0x228) returned 0x1 [0061.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.947] GetFileType (hFile=0x228) returned 0x1 [0061.947] WriteFile (in: hFile=0x228, lpBuffer=0x2272ef0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2272ef0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.948] CloseHandle (hObject=0x228) returned 1 [0061.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.948] GetFileType (hFile=0x228) returned 0x1 [0061.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.948] GetFileType (hFile=0x228) returned 0x1 [0061.949] WriteFile (in: hFile=0x228, lpBuffer=0x2276c70*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2276c70*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.949] CloseHandle (hObject=0x228) returned 1 [0061.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.960] GetFileType (hFile=0x228) returned 0x1 [0061.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.960] GetFileType (hFile=0x228) returned 0x1 [0061.960] WriteFile (in: hFile=0x228, lpBuffer=0x22797c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22797c0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.961] CloseHandle (hObject=0x228) returned 1 [0061.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0061.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0061.961] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.962] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0061.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0061.962] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.962] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.963] GetFileType (hFile=0x228) returned 0x1 [0061.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.963] GetFileType (hFile=0x228) returned 0x1 [0061.963] WriteFile (in: hFile=0x228, lpBuffer=0x22871c0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22871c0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.964] CloseHandle (hObject=0x228) returned 1 [0061.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.965] GetFileType (hFile=0x228) returned 0x1 [0061.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.965] GetFileType (hFile=0x228) returned 0x1 [0061.965] WriteFile (in: hFile=0x228, lpBuffer=0x2288318*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2288318*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.966] CloseHandle (hObject=0x228) returned 1 [0061.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.966] GetFileType (hFile=0x228) returned 0x1 [0061.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.966] GetFileType (hFile=0x228) returned 0x1 [0061.966] WriteFile (in: hFile=0x228, lpBuffer=0x228c098*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x228c098*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.967] CloseHandle (hObject=0x228) returned 1 [0061.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.969] GetFileType (hFile=0x228) returned 0x1 [0061.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.969] GetFileType (hFile=0x228) returned 0x1 [0061.969] WriteFile (in: hFile=0x228, lpBuffer=0x228ebe8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x228ebe8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.970] CloseHandle (hObject=0x228) returned 1 [0061.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0061.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0061.970] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.971] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.971] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0061.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0061.972] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.972] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.972] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.973] GetFileType (hFile=0x228) returned 0x1 [0061.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.973] GetFileType (hFile=0x228) returned 0x1 [0061.973] WriteFile (in: hFile=0x228, lpBuffer=0x229c5e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229c5e8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.974] CloseHandle (hObject=0x228) returned 1 [0061.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.975] GetFileType (hFile=0x228) returned 0x1 [0061.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.975] GetFileType (hFile=0x228) returned 0x1 [0061.975] WriteFile (in: hFile=0x228, lpBuffer=0x229d740*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x229d740*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.976] CloseHandle (hObject=0x228) returned 1 [0061.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.976] GetFileType (hFile=0x228) returned 0x1 [0061.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.977] GetFileType (hFile=0x228) returned 0x1 [0061.977] WriteFile (in: hFile=0x228, lpBuffer=0x22a14c0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22a14c0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.977] CloseHandle (hObject=0x228) returned 1 [0061.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.979] GetFileType (hFile=0x228) returned 0x1 [0061.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.979] GetFileType (hFile=0x228) returned 0x1 [0061.979] WriteFile (in: hFile=0x228, lpBuffer=0x22a4010*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a4010*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.980] CloseHandle (hObject=0x228) returned 1 [0061.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0061.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0061.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.981] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0061.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0061.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.982] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.982] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.982] GetFileType (hFile=0x228) returned 0x1 [0061.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.982] GetFileType (hFile=0x228) returned 0x1 [0061.983] WriteFile (in: hFile=0x228, lpBuffer=0x22b1a10*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b1a10*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0061.983] CloseHandle (hObject=0x228) returned 1 [0061.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.png", lpFilePart=0x0) returned 0x92 [0061.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0061.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0061.984] GetFileType (hFile=0x228) returned 0x1 [0061.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0061.984] GetFileType (hFile=0x228) returned 0x1 [0061.984] WriteFile (in: hFile=0x228, lpBuffer=0x22b2b68*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22b2b68*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0061.985] CloseHandle (hObject=0x228) returned 1 [0061.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0061.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.985] GetFileType (hFile=0x228) returned 0x1 [0061.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.986] GetFileType (hFile=0x228) returned 0x1 [0061.986] WriteFile (in: hFile=0x228, lpBuffer=0x22b68e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22b68e8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0061.986] CloseHandle (hObject=0x228) returned 1 [0061.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0061.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.993] GetFileType (hFile=0x228) returned 0x1 [0061.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0061.993] GetFileType (hFile=0x228) returned 0x1 [0061.993] WriteFile (in: hFile=0x228, lpBuffer=0x22b9438*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b9438*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0061.994] CloseHandle (hObject=0x228) returned 1 [0061.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", lpFilePart=0x0) returned 0x89 [0061.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a [0061.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.997] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.997] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.997] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.997] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0061.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi", lpFilePart=0x0) returned 0x89 [0061.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a [0061.997] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0061.998] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.998] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0061.998] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0061.998] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0061.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0061.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0061.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0061.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0061.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0061.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.png", lpFilePart=0x0) returned 0x92 [0062.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0062.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0062.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c [0062.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d [0062.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.006] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c [0062.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d [0062.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.007] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0062.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.png", lpFilePart=0x0) returned 0x95 [0062.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0062.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0062.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c [0062.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d [0062.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.034] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c [0062.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d [0062.035] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.035] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.035] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.038] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.041] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0062.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.png", lpFilePart=0x0) returned 0x95 [0062.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0062.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0062.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.TXT", lpFilePart=0x0) returned 0x8f [0062.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0062.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0062.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.png", lpFilePart=0x0) returned 0x8f [0062.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0062.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0062.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.vbs", lpFilePart=0x0) returned 0x8f [0062.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0062.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0062.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbb [0062.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0062.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0062.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0062.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", lpFilePart=0x0) returned 0x87 [0062.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", lpFilePart=0x0) returned 0x88 [0062.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0062.125] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.125] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.125] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.125] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0062.125] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0062.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0062.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0062.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata", lpFilePart=0x0) returned 0x87 [0062.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\", lpFilePart=0x0) returned 0x88 [0062.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0062.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0062.126] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0062.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0062.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.TXT", lpFilePart=0x0) returned 0x90 [0062.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0062.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0062.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.png", lpFilePart=0x0) returned 0x90 [0062.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0062.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0062.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.vbs", lpFilePart=0x0) returned 0x90 [0062.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0062.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0062.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbc [0062.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0062.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0062.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.TXT", lpFilePart=0x0) returned 0x86 [0062.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0062.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0062.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.png", lpFilePart=0x0) returned 0x86 [0062.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0062.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.vbs", lpFilePart=0x0) returned 0x86 [0062.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0062.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0062.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xb2 [0062.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0062.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0062.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.TXT", lpFilePart=0x0) returned 0x80 [0062.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0062.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0062.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.png", lpFilePart=0x0) returned 0x80 [0062.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0062.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0062.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.vbs", lpFilePart=0x0) returned 0x80 [0062.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0062.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0062.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xac [0062.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0062.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0062.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0062.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpFilePart=0x0) returned 0x77 [0062.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpFilePart=0x0) returned 0x78 [0062.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0062.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0062.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0062.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0062.169] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0062.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0062.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0062.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf", lpFilePart=0x0) returned 0x77 [0062.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\", lpFilePart=0x0) returned 0x78 [0062.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0062.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0062.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0062.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0062.169] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0062.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0062.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0062.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpFilePart=0x0) returned 0x7e [0062.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpFilePart=0x0) returned 0x7f [0062.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0062.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0062.219] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0062.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0062.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0062.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0", lpFilePart=0x0) returned 0x7e [0062.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\", lpFilePart=0x0) returned 0x7f [0062.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0062.221] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.221] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.221] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.221] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0062.222] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0062.222] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0062.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0062.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x86 [0062.223] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", dwFileAttributes=0x80) returned 1 [0062.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.Horsuke", lpFilePart=0x0) returned 0x8e [0062.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0062.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x86 [0062.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0062.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0062.711] GetFileType (hFile=0x15c) returned 0x1 [0062.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.711] GetFileType (hFile=0x15c) returned 0x1 [0062.711] ReadFile (in: hFile=0x15c, lpBuffer=0x2430488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2430488*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0062.731] WriteFile (in: hFile=0x228, lpBuffer=0x242e918*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x242e918*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0062.733] ReadFile (in: hFile=0x15c, lpBuffer=0x2430488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2430488*, lpNumberOfBytesRead=0x2edb68*=0xa33, lpOverlapped=0x0) returned 1 [0062.733] ReadFile (in: hFile=0x15c, lpBuffer=0x24302a3, nNumberOfBytesToRead=0x1cd, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24302a3*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0062.733] ReadFile (in: hFile=0x15c, lpBuffer=0x2430488, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2430488*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0062.733] CloseHandle (hObject=0x15c) returned 1 [0062.733] WriteFile (in: hFile=0x228, lpBuffer=0x242e918*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x242e918*, lpNumberOfBytesWritten=0x2eda38*=0xa60, lpOverlapped=0x0) returned 1 [0062.733] CloseHandle (hObject=0x228) returned 1 [0062.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png", lpFilePart=0x0) returned 0x86 [0062.734] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0062.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0062.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpFilePart=0x0) returned 0x87 [0062.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpFilePart=0x0) returned 0x88 [0062.736] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0062.746] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.746] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.746] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.746] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.747] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0062.751] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0062.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0062.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0062.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales", lpFilePart=0x0) returned 0x87 [0062.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\", lpFilePart=0x0) returned 0x88 [0062.752] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0062.753] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.753] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.753] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.753] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.754] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.755] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.755] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.758] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0062.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0062.760] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0062.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0062.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x8a [0062.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8b [0062.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.762] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x8a [0062.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8b [0062.763] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.763] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.763] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.763] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.763] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.764] GetFileType (hFile=0x228) returned 0x1 [0062.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.764] GetFileType (hFile=0x228) returned 0x1 [0062.764] WriteFile (in: hFile=0x228, lpBuffer=0x22534c8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22534c8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0062.765] CloseHandle (hObject=0x228) returned 1 [0062.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.766] GetFileType (hFile=0x228) returned 0x1 [0062.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.766] GetFileType (hFile=0x228) returned 0x1 [0062.766] WriteFile (in: hFile=0x228, lpBuffer=0x2254620*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2254620*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0062.767] CloseHandle (hObject=0x228) returned 1 [0062.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.768] GetFileType (hFile=0x228) returned 0x1 [0062.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.768] GetFileType (hFile=0x228) returned 0x1 [0062.768] WriteFile (in: hFile=0x228, lpBuffer=0x22583a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22583a0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0062.769] CloseHandle (hObject=0x228) returned 1 [0062.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.794] GetFileType (hFile=0x228) returned 0x1 [0062.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.794] GetFileType (hFile=0x228) returned 0x1 [0062.795] WriteFile (in: hFile=0x228, lpBuffer=0x225aef0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225aef0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0062.796] CloseHandle (hObject=0x228) returned 1 [0062.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x8a [0062.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8b [0062.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.798] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x8a [0062.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8b [0062.798] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.799] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.801] GetFileType (hFile=0x228) returned 0x1 [0062.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.801] GetFileType (hFile=0x228) returned 0x1 [0062.801] WriteFile (in: hFile=0x228, lpBuffer=0x2268980*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2268980*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0062.803] CloseHandle (hObject=0x228) returned 1 [0062.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.804] GetFileType (hFile=0x228) returned 0x1 [0062.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.804] GetFileType (hFile=0x228) returned 0x1 [0062.804] WriteFile (in: hFile=0x228, lpBuffer=0x2269ad8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2269ad8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0062.805] CloseHandle (hObject=0x228) returned 1 [0062.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.806] GetFileType (hFile=0x228) returned 0x1 [0062.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.806] GetFileType (hFile=0x228) returned 0x1 [0062.806] WriteFile (in: hFile=0x228, lpBuffer=0x226d858*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x226d858*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0062.807] CloseHandle (hObject=0x228) returned 1 [0062.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.809] GetFileType (hFile=0x228) returned 0x1 [0062.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.809] GetFileType (hFile=0x228) returned 0x1 [0062.809] WriteFile (in: hFile=0x228, lpBuffer=0x22703a8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22703a8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0062.810] CloseHandle (hObject=0x228) returned 1 [0062.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.810] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x8a [0062.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8b [0062.811] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.811] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.811] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.811] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.811] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x8a [0062.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8b [0062.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.812] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.812] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.812] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.812] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.813] GetFileType (hFile=0x228) returned 0x1 [0062.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.813] GetFileType (hFile=0x228) returned 0x1 [0062.813] WriteFile (in: hFile=0x228, lpBuffer=0x227de38*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227de38*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0062.814] CloseHandle (hObject=0x228) returned 1 [0062.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.815] GetFileType (hFile=0x228) returned 0x1 [0062.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.815] GetFileType (hFile=0x228) returned 0x1 [0062.815] WriteFile (in: hFile=0x228, lpBuffer=0x227ef90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x227ef90*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0062.816] CloseHandle (hObject=0x228) returned 1 [0062.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.816] GetFileType (hFile=0x228) returned 0x1 [0062.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.816] GetFileType (hFile=0x228) returned 0x1 [0062.816] WriteFile (in: hFile=0x228, lpBuffer=0x2282d10*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2282d10*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0062.817] CloseHandle (hObject=0x228) returned 1 [0062.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.837] GetFileType (hFile=0x228) returned 0x1 [0062.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.837] GetFileType (hFile=0x228) returned 0x1 [0062.837] WriteFile (in: hFile=0x228, lpBuffer=0x2285860*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2285860*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0062.838] CloseHandle (hObject=0x228) returned 1 [0062.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x8a [0062.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8b [0062.838] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.839] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.839] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.839] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.839] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x8a [0062.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8b [0062.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.840] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.846] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpFilePart=0x0) returned 0x8a [0062.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8b [0062.849] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.849] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da", lpFilePart=0x0) returned 0x8a [0062.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8b [0062.849] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.850] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpFilePart=0x0) returned 0x8a [0062.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8b [0062.865] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.866] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.867] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.867] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de", lpFilePart=0x0) returned 0x8a [0062.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8b [0062.867] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.867] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.867] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.867] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.867] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpFilePart=0x0) returned 0x8a [0062.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8b [0062.887] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.887] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.887] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.887] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.887] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el", lpFilePart=0x0) returned 0x8a [0062.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8b [0062.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.888] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.916] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8d [0062.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8e [0062.917] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.918] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8d [0062.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8e [0062.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.918] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0062.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.png", lpFilePart=0x0) returned 0x96 [0062.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0062.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0062.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8d [0062.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8e [0062.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.936] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.936] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.936] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.936] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8d [0062.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8e [0062.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.937] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0062.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.png", lpFilePart=0x0) returned 0x96 [0062.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0062.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0062.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", lpFilePart=0x0) returned 0x8a [0062.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8b [0062.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.949] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.949] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.949] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.949] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es", lpFilePart=0x0) returned 0x8a [0062.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8b [0062.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.950] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8e [0062.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8f [0062.966] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.966] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8e [0062.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8f [0062.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.967] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.TXT", lpFilePart=0x0) returned 0x97 [0062.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.png", lpFilePart=0x0) returned 0x97 [0062.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.vbs", lpFilePart=0x0) returned 0x97 [0062.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc3 [0062.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", lpFilePart=0x0) returned 0x8a [0062.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8b [0062.976] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.985] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et", lpFilePart=0x0) returned 0x8a [0062.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8b [0062.986] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.986] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", lpFilePart=0x0) returned 0x8a [0062.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8b [0062.992] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.993] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0062.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu", lpFilePart=0x0) returned 0x8a [0062.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8b [0062.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0062.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0062.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0062.993] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0062.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0062.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0062.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0062.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.png", lpFilePart=0x0) returned 0x93 [0062.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0062.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0062.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0062.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0062.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0062.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0062.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0062.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0062.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x8a [0063.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8b [0063.016] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.022] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.022] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.023] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x8a [0063.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8b [0063.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.023] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8b [0063.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8c [0063.030] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.030] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8b [0063.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8c [0063.030] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.030] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0063.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.032] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x94 [0063.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0063.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0063.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x8a [0063.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8b [0063.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.045] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x8a [0063.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8b [0063.045] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.046] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", lpFilePart=0x0) returned 0x8a [0063.054] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8b [0063.054] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.055] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he", lpFilePart=0x0) returned 0x8a [0063.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8b [0063.055] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.055] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x8a [0063.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8b [0063.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.070] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x8a [0063.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8b [0063.070] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.070] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.072] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x8a [0063.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8b [0063.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.083] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x8a [0063.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8b [0063.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.084] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x8a [0063.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8b [0063.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.099] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.099] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.100] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.100] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x8a [0063.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8b [0063.100] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.100] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.100] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.100] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.100] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", lpFilePart=0x0) returned 0x8a [0063.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8b [0063.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.114] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.114] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id", lpFilePart=0x0) returned 0x8a [0063.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8b [0063.115] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.115] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.115] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.115] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.115] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", lpFilePart=0x0) returned 0x8a [0063.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8b [0063.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.124] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.124] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.124] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.124] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it", lpFilePart=0x0) returned 0x8a [0063.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8b [0063.124] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.124] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.124] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.124] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.124] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x8a [0063.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8b [0063.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.130] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x8a [0063.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8b [0063.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.131] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x8a [0063.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8b [0063.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.144] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.144] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.144] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.145] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x8a [0063.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8b [0063.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.145] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.152] WriteFile (in: hFile=0x228, lpBuffer=0x2226a28*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2226a28*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.153] CloseHandle (hObject=0x228) returned 1 [0063.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.155] GetFileType (hFile=0x228) returned 0x1 [0063.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.155] GetFileType (hFile=0x228) returned 0x1 [0063.155] WriteFile (in: hFile=0x228, lpBuffer=0x2229578*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2229578*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.156] CloseHandle (hObject=0x228) returned 1 [0063.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x8a [0063.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8b [0063.156] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.157] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x8a [0063.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8b [0063.157] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.157] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.160] GetFileType (hFile=0x228) returned 0x1 [0063.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.160] GetFileType (hFile=0x228) returned 0x1 [0063.161] WriteFile (in: hFile=0x228, lpBuffer=0x2237008*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2237008*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.162] CloseHandle (hObject=0x228) returned 1 [0063.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.162] GetFileType (hFile=0x228) returned 0x1 [0063.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.162] GetFileType (hFile=0x228) returned 0x1 [0063.162] WriteFile (in: hFile=0x228, lpBuffer=0x2238160*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2238160*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.163] CloseHandle (hObject=0x228) returned 1 [0063.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.164] GetFileType (hFile=0x228) returned 0x1 [0063.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.164] GetFileType (hFile=0x228) returned 0x1 [0063.164] WriteFile (in: hFile=0x228, lpBuffer=0x223bee0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x223bee0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.165] CloseHandle (hObject=0x228) returned 1 [0063.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.169] GetFileType (hFile=0x228) returned 0x1 [0063.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.169] GetFileType (hFile=0x228) returned 0x1 [0063.169] WriteFile (in: hFile=0x228, lpBuffer=0x223ea30*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x223ea30*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.170] CloseHandle (hObject=0x228) returned 1 [0063.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x8a [0063.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8b [0063.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.171] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x8a [0063.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8b [0063.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.174] GetFileType (hFile=0x228) returned 0x1 [0063.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.174] GetFileType (hFile=0x228) returned 0x1 [0063.175] WriteFile (in: hFile=0x228, lpBuffer=0x224c4c0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224c4c0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.175] CloseHandle (hObject=0x228) returned 1 [0063.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.176] GetFileType (hFile=0x228) returned 0x1 [0063.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.176] GetFileType (hFile=0x228) returned 0x1 [0063.176] WriteFile (in: hFile=0x228, lpBuffer=0x224d618*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x224d618*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.177] CloseHandle (hObject=0x228) returned 1 [0063.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.177] GetFileType (hFile=0x228) returned 0x1 [0063.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.177] GetFileType (hFile=0x228) returned 0x1 [0063.177] WriteFile (in: hFile=0x228, lpBuffer=0x2251398*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2251398*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.178] CloseHandle (hObject=0x228) returned 1 [0063.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.180] GetFileType (hFile=0x228) returned 0x1 [0063.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.180] GetFileType (hFile=0x228) returned 0x1 [0063.180] WriteFile (in: hFile=0x228, lpBuffer=0x2253ee8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2253ee8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.181] CloseHandle (hObject=0x228) returned 1 [0063.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x8a [0063.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8b [0063.181] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.182] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x8a [0063.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8b [0063.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.182] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.183] GetFileType (hFile=0x228) returned 0x1 [0063.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.183] GetFileType (hFile=0x228) returned 0x1 [0063.183] WriteFile (in: hFile=0x228, lpBuffer=0x2261978*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2261978*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.184] CloseHandle (hObject=0x228) returned 1 [0063.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.185] GetFileType (hFile=0x228) returned 0x1 [0063.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.185] GetFileType (hFile=0x228) returned 0x1 [0063.185] WriteFile (in: hFile=0x228, lpBuffer=0x2262ad0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2262ad0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.186] CloseHandle (hObject=0x228) returned 1 [0063.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.186] GetFileType (hFile=0x228) returned 0x1 [0063.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.186] GetFileType (hFile=0x228) returned 0x1 [0063.186] WriteFile (in: hFile=0x228, lpBuffer=0x2266850*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2266850*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.187] CloseHandle (hObject=0x228) returned 1 [0063.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.194] GetFileType (hFile=0x228) returned 0x1 [0063.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.194] GetFileType (hFile=0x228) returned 0x1 [0063.194] WriteFile (in: hFile=0x228, lpBuffer=0x22693a0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22693a0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.195] CloseHandle (hObject=0x228) returned 1 [0063.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x8a [0063.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8b [0063.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.196] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x8a [0063.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8b [0063.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.197] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.197] GetFileType (hFile=0x228) returned 0x1 [0063.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.197] GetFileType (hFile=0x228) returned 0x1 [0063.198] WriteFile (in: hFile=0x228, lpBuffer=0x2276e30*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2276e30*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.198] CloseHandle (hObject=0x228) returned 1 [0063.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.199] GetFileType (hFile=0x228) returned 0x1 [0063.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.199] GetFileType (hFile=0x228) returned 0x1 [0063.199] WriteFile (in: hFile=0x228, lpBuffer=0x2277f88*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2277f88*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.200] CloseHandle (hObject=0x228) returned 1 [0063.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.200] GetFileType (hFile=0x228) returned 0x1 [0063.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.201] GetFileType (hFile=0x228) returned 0x1 [0063.201] WriteFile (in: hFile=0x228, lpBuffer=0x227bd08*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x227bd08*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.201] CloseHandle (hObject=0x228) returned 1 [0063.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.203] GetFileType (hFile=0x228) returned 0x1 [0063.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.203] GetFileType (hFile=0x228) returned 0x1 [0063.203] WriteFile (in: hFile=0x228, lpBuffer=0x227e858*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227e858*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.204] CloseHandle (hObject=0x228) returned 1 [0063.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", lpFilePart=0x0) returned 0x8a [0063.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8b [0063.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.205] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no", lpFilePart=0x0) returned 0x8a [0063.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8b [0063.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.205] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.206] GetFileType (hFile=0x228) returned 0x1 [0063.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.206] GetFileType (hFile=0x228) returned 0x1 [0063.206] WriteFile (in: hFile=0x228, lpBuffer=0x228c2e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x228c2e8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.207] CloseHandle (hObject=0x228) returned 1 [0063.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.208] GetFileType (hFile=0x228) returned 0x1 [0063.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.208] GetFileType (hFile=0x228) returned 0x1 [0063.208] WriteFile (in: hFile=0x228, lpBuffer=0x228d440*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x228d440*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.209] CloseHandle (hObject=0x228) returned 1 [0063.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.209] GetFileType (hFile=0x228) returned 0x1 [0063.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.209] GetFileType (hFile=0x228) returned 0x1 [0063.210] WriteFile (in: hFile=0x228, lpBuffer=0x22911c0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22911c0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.211] CloseHandle (hObject=0x228) returned 1 [0063.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.212] GetFileType (hFile=0x228) returned 0x1 [0063.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.212] GetFileType (hFile=0x228) returned 0x1 [0063.212] WriteFile (in: hFile=0x228, lpBuffer=0x2293d10*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2293d10*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.213] CloseHandle (hObject=0x228) returned 1 [0063.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x8a [0063.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8b [0063.213] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x8a [0063.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8b [0063.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0063.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.216] GetFileType (hFile=0x228) returned 0x1 [0063.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.216] GetFileType (hFile=0x228) returned 0x1 [0063.216] WriteFile (in: hFile=0x228, lpBuffer=0x22a17a0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a17a0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.217] CloseHandle (hObject=0x228) returned 1 [0063.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x93 [0063.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.217] GetFileType (hFile=0x228) returned 0x1 [0063.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.218] GetFileType (hFile=0x228) returned 0x1 [0063.218] WriteFile (in: hFile=0x228, lpBuffer=0x22a28f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22a28f8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.218] CloseHandle (hObject=0x228) returned 1 [0063.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0063.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0063.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8d [0063.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8e [0063.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.226] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.226] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.226] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.226] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8d [0063.227] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.227] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.227] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.227] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.227] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.236] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.237] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.237] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.263] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.263] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.263] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.263] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.263] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.264] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.271] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.271] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.286] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.286] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.303] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.304] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.304] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.304] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.314] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.315] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.315] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.331] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.332] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.341] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.342] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.349] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.349] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.349] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.365] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.365] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.365] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.366] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.372] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.373] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.373] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.373] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.379] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.379] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.380] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.385] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.386] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.386] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.386] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.404] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0063.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0063.404] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.405] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0063.405] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.405] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.405] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0063.405] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.440] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0063.440] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0063.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0063.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0063.441] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.441] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0063.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0063.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0063.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0063.441] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.441] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0063.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.458] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0063.458] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.459] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0063.460] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.460] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0063.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0063.462] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFilePart=0x0) returned 0x87 [0063.463] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", dwFileAttributes=0x80) returned 1 [0063.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.Horsuke", lpFilePart=0x0) returned 0x8f [0063.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0063.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.466] GetFileType (hFile=0x228) returned 0x1 [0063.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.466] GetFileType (hFile=0x228) returned 0x1 [0063.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFilePart=0x0) returned 0x87 [0063.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0063.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0063.920] GetFileType (hFile=0x15c) returned 0x1 [0063.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.920] GetFileType (hFile=0x15c) returned 0x1 [0063.920] ReadFile (in: hFile=0x15c, lpBuffer=0x230f390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x230f390*, lpNumberOfBytesRead=0x2edb68*=0xd4e, lpOverlapped=0x0) returned 1 [0063.940] ReadFile (in: hFile=0x15c, lpBuffer=0x230f0c6, nNumberOfBytesToRead=0x2b2, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x230f0c6*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0063.940] ReadFile (in: hFile=0x15c, lpBuffer=0x230f390, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x230f390*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0063.940] CloseHandle (hObject=0x15c) returned 1 [0063.940] WriteFile (in: hFile=0x228, lpBuffer=0x230d820*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x230d820*, lpNumberOfBytesWritten=0x2eda38*=0xd70, lpOverlapped=0x0) returned 1 [0063.941] CloseHandle (hObject=0x228) returned 1 [0063.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png", lpFilePart=0x0) returned 0x87 [0063.941] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0063.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0063.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", lpFilePart=0x0) returned 0x88 [0063.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", lpFilePart=0x0) returned 0x89 [0063.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0063.952] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0063.958] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0063.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0063.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0063.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales", lpFilePart=0x0) returned 0x88 [0063.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\", lpFilePart=0x0) returned 0x89 [0063.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0063.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.961] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.962] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0063.963] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0063.963] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0063.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0063.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", lpFilePart=0x0) returned 0x8b [0063.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8c [0063.964] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.965] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar", lpFilePart=0x0) returned 0x8b [0063.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8c [0063.965] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.966] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0063.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.970] GetFileType (hFile=0x228) returned 0x1 [0063.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.970] GetFileType (hFile=0x228) returned 0x1 [0063.971] WriteFile (in: hFile=0x228, lpBuffer=0x232edd8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x232edd8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.972] CloseHandle (hObject=0x228) returned 1 [0063.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x94 [0063.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0063.972] GetFileType (hFile=0x228) returned 0x1 [0063.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0063.972] GetFileType (hFile=0x228) returned 0x1 [0063.972] WriteFile (in: hFile=0x228, lpBuffer=0x232ff38*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x232ff38*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0063.973] CloseHandle (hObject=0x228) returned 1 [0063.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0063.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.974] GetFileType (hFile=0x228) returned 0x1 [0063.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.974] GetFileType (hFile=0x228) returned 0x1 [0063.974] WriteFile (in: hFile=0x228, lpBuffer=0x2333cd0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2333cd0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0063.976] CloseHandle (hObject=0x228) returned 1 [0063.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0063.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.993] GetFileType (hFile=0x228) returned 0x1 [0063.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.993] GetFileType (hFile=0x228) returned 0x1 [0063.993] WriteFile (in: hFile=0x228, lpBuffer=0x2336830*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2336830*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0063.994] CloseHandle (hObject=0x228) returned 1 [0063.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", lpFilePart=0x0) returned 0x8b [0063.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8c [0063.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.996] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0063.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg", lpFilePart=0x0) returned 0x8b [0063.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8c [0063.996] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0063.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0063.997] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0063.997] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0063.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0063.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0063.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0063.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0063.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0063.998] GetFileType (hFile=0x228) returned 0x1 [0063.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0063.998] GetFileType (hFile=0x228) returned 0x1 [0063.998] WriteFile (in: hFile=0x228, lpBuffer=0x23442f0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x23442f0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0063.999] CloseHandle (hObject=0x228) returned 1 [0063.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x94 [0063.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0063.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.000] GetFileType (hFile=0x228) returned 0x1 [0064.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.000] GetFileType (hFile=0x228) returned 0x1 [0064.000] WriteFile (in: hFile=0x228, lpBuffer=0x2345450*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2345450*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.001] CloseHandle (hObject=0x228) returned 1 [0064.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.001] GetFileType (hFile=0x228) returned 0x1 [0064.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.001] GetFileType (hFile=0x228) returned 0x1 [0064.001] WriteFile (in: hFile=0x228, lpBuffer=0x23491e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x23491e8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.002] CloseHandle (hObject=0x228) returned 1 [0064.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.022] GetFileType (hFile=0x228) returned 0x1 [0064.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.022] GetFileType (hFile=0x228) returned 0x1 [0064.022] WriteFile (in: hFile=0x228, lpBuffer=0x234bd48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x234bd48*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.023] CloseHandle (hObject=0x228) returned 1 [0064.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", lpFilePart=0x0) returned 0x8b [0064.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8c [0064.025] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.025] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.025] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.025] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.026] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca", lpFilePart=0x0) returned 0x8b [0064.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8c [0064.026] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.026] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.026] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.026] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.026] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.027] GetFileType (hFile=0x228) returned 0x1 [0064.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.027] GetFileType (hFile=0x228) returned 0x1 [0064.027] WriteFile (in: hFile=0x228, lpBuffer=0x2359808*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2359808*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.028] CloseHandle (hObject=0x228) returned 1 [0064.028] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.029] GetFileType (hFile=0x228) returned 0x1 [0064.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.029] GetFileType (hFile=0x228) returned 0x1 [0064.029] WriteFile (in: hFile=0x228, lpBuffer=0x235a968*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x235a968*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.030] CloseHandle (hObject=0x228) returned 1 [0064.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.038] GetFileType (hFile=0x228) returned 0x1 [0064.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.038] GetFileType (hFile=0x228) returned 0x1 [0064.038] WriteFile (in: hFile=0x228, lpBuffer=0x235e700*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x235e700*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.040] CloseHandle (hObject=0x228) returned 1 [0064.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.179] GetFileType (hFile=0x228) returned 0x1 [0064.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.179] GetFileType (hFile=0x228) returned 0x1 [0064.179] WriteFile (in: hFile=0x228, lpBuffer=0x2361260*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2361260*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.180] CloseHandle (hObject=0x228) returned 1 [0064.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", lpFilePart=0x0) returned 0x8b [0064.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8c [0064.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.182] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs", lpFilePart=0x0) returned 0x8b [0064.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8c [0064.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.183] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.183] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", lpFilePart=0x0) returned 0x8b [0064.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8c [0064.201] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.202] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.202] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da", lpFilePart=0x0) returned 0x8b [0064.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8c [0064.202] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.202] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.203] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", lpFilePart=0x0) returned 0x8b [0064.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8c [0064.242] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.243] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.243] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.243] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.243] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de", lpFilePart=0x0) returned 0x8b [0064.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8c [0064.243] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.243] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.243] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.243] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.243] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", lpFilePart=0x0) returned 0x8b [0064.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8c [0064.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.254] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.254] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.254] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.254] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el", lpFilePart=0x0) returned 0x8b [0064.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8c [0064.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.255] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.255] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.255] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.255] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", lpFilePart=0x0) returned 0x8b [0064.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8c [0064.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.279] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en", lpFilePart=0x0) returned 0x8b [0064.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8c [0064.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.280] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", lpFilePart=0x0) returned 0x8b [0064.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8c [0064.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.288] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es", lpFilePart=0x0) returned 0x8b [0064.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8c [0064.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.289] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.289] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.289] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.289] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", lpFilePart=0x0) returned 0x8b [0064.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8c [0064.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.303] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi", lpFilePart=0x0) returned 0x8b [0064.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8c [0064.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.303] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.307] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", lpFilePart=0x0) returned 0x8c [0064.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8d [0064.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.327] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil", lpFilePart=0x0) returned 0x8c [0064.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8d [0064.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.327] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0064.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x95 [0064.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0064.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0064.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", lpFilePart=0x0) returned 0x8b [0064.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8c [0064.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.352] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr", lpFilePart=0x0) returned 0x8b [0064.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8c [0064.353] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.353] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.353] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.353] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.353] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", lpFilePart=0x0) returned 0x8b [0064.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8c [0064.586] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.586] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.586] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he", lpFilePart=0x0) returned 0x8b [0064.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8c [0064.587] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.587] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.587] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.664] GetFileType (hFile=0x228) returned 0x1 [0064.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.664] GetFileType (hFile=0x228) returned 0x1 [0064.664] WriteFile (in: hFile=0x228, lpBuffer=0x2232e38*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2232e38*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.665] CloseHandle (hObject=0x228) returned 1 [0064.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.665] GetFileType (hFile=0x228) returned 0x1 [0064.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.665] GetFileType (hFile=0x228) returned 0x1 [0064.665] WriteFile (in: hFile=0x228, lpBuffer=0x2233f98*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2233f98*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.666] CloseHandle (hObject=0x228) returned 1 [0064.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.667] GetFileType (hFile=0x228) returned 0x1 [0064.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.667] GetFileType (hFile=0x228) returned 0x1 [0064.667] WriteFile (in: hFile=0x228, lpBuffer=0x2237d30*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2237d30*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.668] CloseHandle (hObject=0x228) returned 1 [0064.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.714] GetFileType (hFile=0x228) returned 0x1 [0064.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.714] GetFileType (hFile=0x228) returned 0x1 [0064.714] WriteFile (in: hFile=0x228, lpBuffer=0x223a890*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x223a890*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.715] CloseHandle (hObject=0x228) returned 1 [0064.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", lpFilePart=0x0) returned 0x8b [0064.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8c [0064.715] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.716] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.716] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.716] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.716] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi", lpFilePart=0x0) returned 0x8b [0064.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8c [0064.717] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.717] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.717] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.722] GetFileType (hFile=0x228) returned 0x1 [0064.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.722] GetFileType (hFile=0x228) returned 0x1 [0064.722] WriteFile (in: hFile=0x228, lpBuffer=0x2248350*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2248350*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.723] CloseHandle (hObject=0x228) returned 1 [0064.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.723] GetFileType (hFile=0x228) returned 0x1 [0064.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.724] GetFileType (hFile=0x228) returned 0x1 [0064.724] WriteFile (in: hFile=0x228, lpBuffer=0x22494b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22494b0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.724] CloseHandle (hObject=0x228) returned 1 [0064.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.725] GetFileType (hFile=0x228) returned 0x1 [0064.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.725] GetFileType (hFile=0x228) returned 0x1 [0064.725] WriteFile (in: hFile=0x228, lpBuffer=0x224d248*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224d248*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.726] CloseHandle (hObject=0x228) returned 1 [0064.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.727] GetFileType (hFile=0x228) returned 0x1 [0064.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.727] GetFileType (hFile=0x228) returned 0x1 [0064.727] WriteFile (in: hFile=0x228, lpBuffer=0x224fda8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224fda8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.728] CloseHandle (hObject=0x228) returned 1 [0064.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", lpFilePart=0x0) returned 0x8b [0064.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8c [0064.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.729] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr", lpFilePart=0x0) returned 0x8b [0064.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8c [0064.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.730] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.731] GetFileType (hFile=0x228) returned 0x1 [0064.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.731] GetFileType (hFile=0x228) returned 0x1 [0064.731] WriteFile (in: hFile=0x228, lpBuffer=0x225d868*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225d868*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.732] CloseHandle (hObject=0x228) returned 1 [0064.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.733] GetFileType (hFile=0x228) returned 0x1 [0064.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.733] GetFileType (hFile=0x228) returned 0x1 [0064.733] WriteFile (in: hFile=0x228, lpBuffer=0x225e9c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x225e9c8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.734] CloseHandle (hObject=0x228) returned 1 [0064.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.734] GetFileType (hFile=0x228) returned 0x1 [0064.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.735] GetFileType (hFile=0x228) returned 0x1 [0064.735] WriteFile (in: hFile=0x228, lpBuffer=0x2262760*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2262760*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.736] CloseHandle (hObject=0x228) returned 1 [0064.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.785] GetFileType (hFile=0x228) returned 0x1 [0064.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.785] GetFileType (hFile=0x228) returned 0x1 [0064.785] WriteFile (in: hFile=0x228, lpBuffer=0x22652c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22652c0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.786] CloseHandle (hObject=0x228) returned 1 [0064.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", lpFilePart=0x0) returned 0x8b [0064.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8c [0064.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.787] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.787] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.787] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.787] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu", lpFilePart=0x0) returned 0x8b [0064.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8c [0064.787] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.788] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.789] GetFileType (hFile=0x228) returned 0x1 [0064.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.789] GetFileType (hFile=0x228) returned 0x1 [0064.789] WriteFile (in: hFile=0x228, lpBuffer=0x2272d80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2272d80*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.790] CloseHandle (hObject=0x228) returned 1 [0064.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.790] GetFileType (hFile=0x228) returned 0x1 [0064.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.790] GetFileType (hFile=0x228) returned 0x1 [0064.790] WriteFile (in: hFile=0x228, lpBuffer=0x2273ee0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2273ee0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.791] CloseHandle (hObject=0x228) returned 1 [0064.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.792] GetFileType (hFile=0x228) returned 0x1 [0064.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.792] GetFileType (hFile=0x228) returned 0x1 [0064.792] WriteFile (in: hFile=0x228, lpBuffer=0x2277c78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2277c78*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.793] CloseHandle (hObject=0x228) returned 1 [0064.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.868] GetFileType (hFile=0x228) returned 0x1 [0064.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.868] GetFileType (hFile=0x228) returned 0x1 [0064.868] WriteFile (in: hFile=0x228, lpBuffer=0x227a7d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227a7d8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.869] CloseHandle (hObject=0x228) returned 1 [0064.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", lpFilePart=0x0) returned 0x8b [0064.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8c [0064.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.870] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id", lpFilePart=0x0) returned 0x8b [0064.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8c [0064.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.870] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.871] GetFileType (hFile=0x228) returned 0x1 [0064.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.871] GetFileType (hFile=0x228) returned 0x1 [0064.871] WriteFile (in: hFile=0x228, lpBuffer=0x2288298*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2288298*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.872] CloseHandle (hObject=0x228) returned 1 [0064.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.873] GetFileType (hFile=0x228) returned 0x1 [0064.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.873] GetFileType (hFile=0x228) returned 0x1 [0064.873] WriteFile (in: hFile=0x228, lpBuffer=0x22893f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22893f8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.874] CloseHandle (hObject=0x228) returned 1 [0064.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.874] GetFileType (hFile=0x228) returned 0x1 [0064.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.874] GetFileType (hFile=0x228) returned 0x1 [0064.874] WriteFile (in: hFile=0x228, lpBuffer=0x228d190*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x228d190*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.875] CloseHandle (hObject=0x228) returned 1 [0064.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.940] GetFileType (hFile=0x228) returned 0x1 [0064.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.940] GetFileType (hFile=0x228) returned 0x1 [0064.940] WriteFile (in: hFile=0x228, lpBuffer=0x228fcf0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x228fcf0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.941] CloseHandle (hObject=0x228) returned 1 [0064.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", lpFilePart=0x0) returned 0x8b [0064.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8c [0064.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.943] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it", lpFilePart=0x0) returned 0x8b [0064.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8c [0064.943] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.943] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.944] GetFileType (hFile=0x228) returned 0x1 [0064.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.944] GetFileType (hFile=0x228) returned 0x1 [0064.944] WriteFile (in: hFile=0x228, lpBuffer=0x229d7b0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229d7b0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0064.945] CloseHandle (hObject=0x228) returned 1 [0064.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.946] GetFileType (hFile=0x228) returned 0x1 [0064.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.946] GetFileType (hFile=0x228) returned 0x1 [0064.946] WriteFile (in: hFile=0x228, lpBuffer=0x229e910*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x229e910*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0064.947] CloseHandle (hObject=0x228) returned 1 [0064.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.947] GetFileType (hFile=0x228) returned 0x1 [0064.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.947] GetFileType (hFile=0x228) returned 0x1 [0064.947] WriteFile (in: hFile=0x228, lpBuffer=0x22a26a8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22a26a8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0064.948] CloseHandle (hObject=0x228) returned 1 [0064.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.957] GetFileType (hFile=0x228) returned 0x1 [0064.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.957] GetFileType (hFile=0x228) returned 0x1 [0064.957] WriteFile (in: hFile=0x228, lpBuffer=0x22a5208*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a5208*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0064.958] CloseHandle (hObject=0x228) returned 1 [0064.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", lpFilePart=0x0) returned 0x8b [0064.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8c [0064.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.959] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja", lpFilePart=0x0) returned 0x8b [0064.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8c [0064.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.960] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", lpFilePart=0x0) returned 0x8b [0064.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8c [0064.971] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.983] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko", lpFilePart=0x0) returned 0x8b [0064.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8c [0064.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0064.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0064.984] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0064.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0064.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0064.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0064.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x94 [0064.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0064.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0064.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0064.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0064.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0064.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0064.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0064.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0064.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0064.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", lpFilePart=0x0) returned 0x8b [0064.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8c [0064.999] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0064.999] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.000] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.000] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.000] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt", lpFilePart=0x0) returned 0x8b [0065.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8c [0065.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.000] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.000] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.000] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.000] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", lpFilePart=0x0) returned 0x8b [0065.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8c [0065.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.019] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.019] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.019] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.019] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv", lpFilePart=0x0) returned 0x8b [0065.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8c [0065.019] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.020] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.020] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.020] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.020] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", lpFilePart=0x0) returned 0x8b [0065.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8c [0065.033] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.033] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.034] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl", lpFilePart=0x0) returned 0x8b [0065.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8c [0065.034] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.034] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.034] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", lpFilePart=0x0) returned 0x8b [0065.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8c [0065.042] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.043] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.043] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.043] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.043] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no", lpFilePart=0x0) returned 0x8b [0065.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8c [0065.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.044] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.044] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", lpFilePart=0x0) returned 0x8b [0065.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8c [0065.055] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.055] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.056] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.056] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.056] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl", lpFilePart=0x0) returned 0x8b [0065.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8c [0065.056] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.056] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.056] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.056] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.057] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8e [0065.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8f [0065.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.073] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8e [0065.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8f [0065.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.074] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.TXT", lpFilePart=0x0) returned 0x97 [0065.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.png", lpFilePart=0x0) returned 0x97 [0065.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.vbs", lpFilePart=0x0) returned 0x97 [0065.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc3 [0065.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8e [0065.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8f [0065.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.084] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8e [0065.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8f [0065.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.084] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.TXT", lpFilePart=0x0) returned 0x97 [0065.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.png", lpFilePart=0x0) returned 0x97 [0065.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.vbs", lpFilePart=0x0) returned 0x97 [0065.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc3 [0065.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", lpFilePart=0x0) returned 0x8b [0065.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8c [0065.099] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.100] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.100] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.101] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.101] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro", lpFilePart=0x0) returned 0x8b [0065.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8c [0065.101] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.101] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.101] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.101] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.101] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.101] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", lpFilePart=0x0) returned 0x8b [0065.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8c [0065.116] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.116] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.117] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.117] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.117] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru", lpFilePart=0x0) returned 0x8b [0065.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8c [0065.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.117] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.117] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.117] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.117] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", lpFilePart=0x0) returned 0x8b [0065.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8c [0065.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.132] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk", lpFilePart=0x0) returned 0x8b [0065.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8c [0065.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.132] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", lpFilePart=0x0) returned 0x8b [0065.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8c [0065.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.147] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl", lpFilePart=0x0) returned 0x8b [0065.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8c [0065.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.148] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x8b [0065.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8c [0065.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.164] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr", lpFilePart=0x0) returned 0x8b [0065.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8c [0065.165] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.165] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.165] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x8b [0065.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8c [0065.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv", lpFilePart=0x0) returned 0x8b [0065.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8c [0065.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x8b [0065.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8c [0065.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.191] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.191] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.191] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.191] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th", lpFilePart=0x0) returned 0x8b [0065.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8c [0065.192] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.192] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.192] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.192] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.192] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x8b [0065.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8c [0065.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr", lpFilePart=0x0) returned 0x8b [0065.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8c [0065.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.216] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.216] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x8b [0065.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8c [0065.246] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.247] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.247] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.247] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.247] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk", lpFilePart=0x0) returned 0x8b [0065.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8c [0065.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.248] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x8b [0065.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8c [0065.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.274] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi", lpFilePart=0x0) returned 0x8b [0065.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8c [0065.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.274] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.TXT", lpFilePart=0x0) returned 0x94 [0065.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.278] GetFileType (hFile=0x228) returned 0x1 [0065.278] GetFileType (hFile=0x228) returned 0x1 [0065.278] WriteFile (in: hFile=0x228, lpBuffer=0x2232b20*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2232b20*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0065.279] CloseHandle (hObject=0x228) returned 1 [0065.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.png", lpFilePart=0x0) returned 0x94 [0065.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.280] GetFileType (hFile=0x228) returned 0x1 [0065.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.280] GetFileType (hFile=0x228) returned 0x1 [0065.280] WriteFile (in: hFile=0x228, lpBuffer=0x2233c80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2233c80*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0065.281] CloseHandle (hObject=0x228) returned 1 [0065.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0065.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.281] GetFileType (hFile=0x228) returned 0x1 [0065.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.282] GetFileType (hFile=0x228) returned 0x1 [0065.282] WriteFile (in: hFile=0x228, lpBuffer=0x2237a18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2237a18*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0065.282] CloseHandle (hObject=0x228) returned 1 [0065.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0065.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.284] GetFileType (hFile=0x228) returned 0x1 [0065.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.284] GetFileType (hFile=0x228) returned 0x1 [0065.284] WriteFile (in: hFile=0x228, lpBuffer=0x223a578*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x223a578*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0065.285] CloseHandle (hObject=0x228) returned 1 [0065.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8e [0065.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8f [0065.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.286] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.287] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8e [0065.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8f [0065.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.287] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.287] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.287] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.287] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.TXT", lpFilePart=0x0) returned 0x97 [0065.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.290] GetFileType (hFile=0x228) returned 0x1 [0065.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.290] GetFileType (hFile=0x228) returned 0x1 [0065.291] WriteFile (in: hFile=0x228, lpBuffer=0x2248108*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2248108*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0065.292] CloseHandle (hObject=0x228) returned 1 [0065.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.png", lpFilePart=0x0) returned 0x97 [0065.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.293] GetFileType (hFile=0x228) returned 0x1 [0065.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.293] GetFileType (hFile=0x228) returned 0x1 [0065.293] WriteFile (in: hFile=0x228, lpBuffer=0x2249268*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2249268*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0065.294] CloseHandle (hObject=0x228) returned 1 [0065.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.vbs", lpFilePart=0x0) returned 0x97 [0065.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.295] GetFileType (hFile=0x228) returned 0x1 [0065.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.295] GetFileType (hFile=0x228) returned 0x1 [0065.295] WriteFile (in: hFile=0x228, lpBuffer=0x224d000*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224d000*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0065.296] CloseHandle (hObject=0x228) returned 1 [0065.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc3 [0065.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.308] GetFileType (hFile=0x228) returned 0x1 [0065.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.308] GetFileType (hFile=0x228) returned 0x1 [0065.309] WriteFile (in: hFile=0x228, lpBuffer=0x224fb60*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224fb60*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0065.309] CloseHandle (hObject=0x228) returned 1 [0065.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8e [0065.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8f [0065.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.310] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.310] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.310] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.310] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8e [0065.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8f [0065.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0065.311] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.311] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0065.311] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0065.311] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0065.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.TXT", lpFilePart=0x0) returned 0x97 [0065.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.313] GetFileType (hFile=0x228) returned 0x1 [0065.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.313] GetFileType (hFile=0x228) returned 0x1 [0065.313] WriteFile (in: hFile=0x228, lpBuffer=0x225d6f0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225d6f0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0065.314] CloseHandle (hObject=0x228) returned 1 [0065.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.png", lpFilePart=0x0) returned 0x97 [0065.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0065.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.314] GetFileType (hFile=0x228) returned 0x1 [0065.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0065.315] GetFileType (hFile=0x228) returned 0x1 [0065.315] WriteFile (in: hFile=0x228, lpBuffer=0x225e850*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x225e850*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0065.316] CloseHandle (hObject=0x228) returned 1 [0065.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.vbs", lpFilePart=0x0) returned 0x97 [0065.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.318] GetFileType (hFile=0x228) returned 0x1 [0065.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.318] GetFileType (hFile=0x228) returned 0x1 [0065.318] WriteFile (in: hFile=0x228, lpBuffer=0x22625e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22625e8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0065.323] CloseHandle (hObject=0x228) returned 1 [0065.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc3 [0065.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0065.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.348] GetFileType (hFile=0x228) returned 0x1 [0065.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0065.349] GetFileType (hFile=0x228) returned 0x1 [0065.349] WriteFile (in: hFile=0x228, lpBuffer=0x2265148*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2265148*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0065.350] CloseHandle (hObject=0x228) returned 1 [0065.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.TXT", lpFilePart=0x0) returned 0x91 [0065.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0065.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.350] GetFileType (hFile=0x228) returned 0x1 [0065.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0065.350] GetFileType (hFile=0x228) returned 0x1 [0065.351] WriteFile (in: hFile=0x228, lpBuffer=0x226f580*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x226f580*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0065.352] CloseHandle (hObject=0x228) returned 1 [0065.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.png", lpFilePart=0x0) returned 0x91 [0065.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0065.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.352] GetFileType (hFile=0x228) returned 0x1 [0065.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0065.352] GetFileType (hFile=0x228) returned 0x1 [0065.352] WriteFile (in: hFile=0x228, lpBuffer=0x22706d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x22706d8*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0065.353] CloseHandle (hObject=0x228) returned 1 [0065.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.vbs", lpFilePart=0x0) returned 0x91 [0065.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0065.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.354] GetFileType (hFile=0x228) returned 0x1 [0065.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0065.354] GetFileType (hFile=0x228) returned 0x1 [0065.354] WriteFile (in: hFile=0x228, lpBuffer=0x2274458*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x2274458*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0065.355] CloseHandle (hObject=0x228) returned 1 [0065.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbd [0065.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0065.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.361] GetFileType (hFile=0x228) returned 0x1 [0065.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0065.361] GetFileType (hFile=0x228) returned 0x1 [0065.362] WriteFile (in: hFile=0x228, lpBuffer=0x2276fa8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x2276fa8*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0065.363] CloseHandle (hObject=0x228) returned 1 [0065.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0065.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", lpFilePart=0x0) returned 0x89 [0065.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", lpFilePart=0x0) returned 0x8a [0065.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0065.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0065.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0065.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0065.363] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0065.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0065.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0065.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata", lpFilePart=0x0) returned 0x89 [0065.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\", lpFilePart=0x0) returned 0x8a [0065.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0065.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0065.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0065.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0065.364] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0065.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0065.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0065.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0065.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.365] GetFileType (hFile=0x228) returned 0x1 [0065.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0065.365] GetFileType (hFile=0x228) returned 0x1 [0065.365] WriteFile (in: hFile=0x228, lpBuffer=0x2284a38*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x2284a38*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0065.366] CloseHandle (hObject=0x228) returned 1 [0065.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.png", lpFilePart=0x0) returned 0x92 [0065.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0065.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.367] GetFileType (hFile=0x228) returned 0x1 [0065.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0065.367] GetFileType (hFile=0x228) returned 0x1 [0065.367] WriteFile (in: hFile=0x228, lpBuffer=0x2285b90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2285b90*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0065.368] CloseHandle (hObject=0x228) returned 1 [0065.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0065.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0065.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.368] GetFileType (hFile=0x228) returned 0x1 [0065.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0065.368] GetFileType (hFile=0x228) returned 0x1 [0065.368] WriteFile (in: hFile=0x228, lpBuffer=0x2289910*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x2289910*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0065.369] CloseHandle (hObject=0x228) returned 1 [0065.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0065.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0065.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.386] GetFileType (hFile=0x228) returned 0x1 [0065.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0065.386] GetFileType (hFile=0x228) returned 0x1 [0065.386] WriteFile (in: hFile=0x228, lpBuffer=0x228c460*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x228c460*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0065.387] CloseHandle (hObject=0x228) returned 1 [0065.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.TXT", lpFilePart=0x0) returned 0x88 [0065.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0065.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.388] GetFileType (hFile=0x228) returned 0x1 [0065.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0065.388] GetFileType (hFile=0x228) returned 0x1 [0065.388] WriteFile (in: hFile=0x228, lpBuffer=0x2296878*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x2296878*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0065.389] CloseHandle (hObject=0x228) returned 1 [0065.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.png", lpFilePart=0x0) returned 0x88 [0065.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0065.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.390] GetFileType (hFile=0x228) returned 0x1 [0065.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0065.390] GetFileType (hFile=0x228) returned 0x1 [0065.390] WriteFile (in: hFile=0x228, lpBuffer=0x22979c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22979c0*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0065.391] CloseHandle (hObject=0x228) returned 1 [0065.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.vbs", lpFilePart=0x0) returned 0x88 [0065.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0065.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.391] GetFileType (hFile=0x228) returned 0x1 [0065.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0065.391] GetFileType (hFile=0x228) returned 0x1 [0065.391] WriteFile (in: hFile=0x228, lpBuffer=0x229b710*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x229b710*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0065.392] CloseHandle (hObject=0x228) returned 1 [0065.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xb4 [0065.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0065.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.393] GetFileType (hFile=0x228) returned 0x1 [0065.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0065.393] GetFileType (hFile=0x228) returned 0x1 [0065.393] WriteFile (in: hFile=0x228, lpBuffer=0x229e240*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x229e240*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0065.401] CloseHandle (hObject=0x228) returned 1 [0065.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.TXT", lpFilePart=0x0) returned 0x80 [0065.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0065.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.402] GetFileType (hFile=0x228) returned 0x1 [0065.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0065.402] GetFileType (hFile=0x228) returned 0x1 [0065.402] WriteFile (in: hFile=0x228, lpBuffer=0x22a8638*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22a8638*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0065.403] CloseHandle (hObject=0x228) returned 1 [0065.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.png", lpFilePart=0x0) returned 0x80 [0065.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0065.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.404] GetFileType (hFile=0x228) returned 0x1 [0065.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0065.404] GetFileType (hFile=0x228) returned 0x1 [0065.404] WriteFile (in: hFile=0x228, lpBuffer=0x22a9770*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x22a9770*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0065.405] CloseHandle (hObject=0x228) returned 1 [0065.405] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.vbs", lpFilePart=0x0) returned 0x80 [0065.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0065.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.416] GetFileType (hFile=0x228) returned 0x1 [0065.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0065.416] GetFileType (hFile=0x228) returned 0x1 [0065.416] WriteFile (in: hFile=0x228, lpBuffer=0x22ad490*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x22ad490*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0065.417] CloseHandle (hObject=0x228) returned 1 [0065.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xac [0065.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0065.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0065.418] GetFileType (hFile=0x228) returned 0x1 [0065.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0065.418] GetFileType (hFile=0x228) returned 0x1 [0065.418] WriteFile (in: hFile=0x228, lpBuffer=0x22affa0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22affa0*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0065.419] CloseHandle (hObject=0x228) returned 1 [0065.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0065.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", lpFilePart=0x0) returned 0x77 [0065.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\", lpFilePart=0x0) returned 0x78 [0065.419] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0065.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0065.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0065.420] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0065.420] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0065.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0065.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0065.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap", lpFilePart=0x0) returned 0x77 [0065.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\", lpFilePart=0x0) returned 0x78 [0065.420] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0065.421] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0065.421] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0065.421] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0065.421] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0065.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0065.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0065.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", lpFilePart=0x0) returned 0x7d [0065.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\", lpFilePart=0x0) returned 0x7e [0065.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0065.442] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0065.443] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0065.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0065.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0065.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0", lpFilePart=0x0) returned 0x7d [0065.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\", lpFilePart=0x0) returned 0x7e [0065.444] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0065.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0065.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0065.446] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0065.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0065.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0065.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0065.447] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", dwFileAttributes=0x80) returned 1 [0065.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.Horsuke", lpFilePart=0x0) returned 0x92 [0065.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0065.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0065.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0065.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0065.906] GetFileType (hFile=0x15c) returned 0x1 [0065.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.906] GetFileType (hFile=0x15c) returned 0x1 [0065.906] ReadFile (in: hFile=0x15c, lpBuffer=0x23a1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23a1088*, lpNumberOfBytesRead=0x2edb68*=0xd47, lpOverlapped=0x0) returned 1 [0065.924] ReadFile (in: hFile=0x15c, lpBuffer=0x23a0db7, nNumberOfBytesToRead=0x2b9, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23a0db7*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0065.925] ReadFile (in: hFile=0x15c, lpBuffer=0x23a1088, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23a1088*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0065.925] CloseHandle (hObject=0x15c) returned 1 [0065.925] WriteFile (in: hFile=0x228, lpBuffer=0x239f500*, nNumberOfBytesToWrite=0xd70, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x239f500*, lpNumberOfBytesWritten=0x2eda38*=0xd70, lpOverlapped=0x0) returned 1 [0065.926] CloseHandle (hObject=0x228) returned 1 [0065.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png", lpFilePart=0x0) returned 0x8a [0065.926] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0065.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0065.927] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", dwFileAttributes=0x80) returned 1 [0065.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.Horsuke", lpFilePart=0x0) returned 0x91 [0065.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0065.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0065.929] GetFileType (hFile=0x228) returned 0x1 [0065.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0065.929] GetFileType (hFile=0x228) returned 0x1 [0066.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0066.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0066.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0066.647] GetFileType (hFile=0x15c) returned 0x1 [0066.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0066.647] GetFileType (hFile=0x15c) returned 0x1 [0066.647] ReadFile (in: hFile=0x15c, lpBuffer=0x228aab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x228aab0*, lpNumberOfBytesRead=0x2edb68*=0x9d, lpOverlapped=0x0) returned 1 [0066.648] ReadFile (in: hFile=0x15c, lpBuffer=0x228aab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x228aab0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0066.648] CloseHandle (hObject=0x15c) returned 1 [0066.648] WriteFile (in: hFile=0x228, lpBuffer=0x2288f30*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2288f30*, lpNumberOfBytesWritten=0x2eda38*=0xc0, lpOverlapped=0x0) returned 1 [0066.649] CloseHandle (hObject=0x228) returned 1 [0066.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png", lpFilePart=0x0) returned 0x89 [0066.649] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0066.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFilePart=0x0) returned 0x87 [0066.650] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", dwFileAttributes=0x80) returned 1 [0066.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.Horsuke", lpFilePart=0x0) returned 0x8f [0066.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0066.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0066.652] GetFileType (hFile=0x228) returned 0x1 [0066.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0066.652] GetFileType (hFile=0x228) returned 0x1 [0067.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFilePart=0x0) returned 0x87 [0067.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0067.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0067.123] GetFileType (hFile=0x15c) returned 0x1 [0067.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.123] GetFileType (hFile=0x15c) returned 0x1 [0067.123] ReadFile (in: hFile=0x15c, lpBuffer=0x2373708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2373708*, lpNumberOfBytesRead=0x2edb68*=0x5c, lpOverlapped=0x0) returned 1 [0067.124] ReadFile (in: hFile=0x15c, lpBuffer=0x2373708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2373708*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0067.124] CloseHandle (hObject=0x15c) returned 1 [0067.124] WriteFile (in: hFile=0x228, lpBuffer=0x2371b90*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2371b90*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0067.125] CloseHandle (hObject=0x228) returned 1 [0067.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html", lpFilePart=0x0) returned 0x87 [0067.125] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1 [0067.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFilePart=0x0) returned 0x85 [0067.126] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", dwFileAttributes=0x80) returned 1 [0067.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.Horsuke", lpFilePart=0x0) returned 0x8d [0067.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0067.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.127] GetFileType (hFile=0x228) returned 0x1 [0067.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.127] GetFileType (hFile=0x228) returned 0x1 [0067.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFilePart=0x0) returned 0x85 [0067.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0067.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0067.608] GetFileType (hFile=0x15c) returned 0x1 [0067.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.608] GetFileType (hFile=0x15c) returned 0x1 [0067.608] ReadFile (in: hFile=0x15c, lpBuffer=0x225c398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x225c398*, lpNumberOfBytesRead=0x2edb68*=0x5f, lpOverlapped=0x0) returned 1 [0067.609] ReadFile (in: hFile=0x15c, lpBuffer=0x225c398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x225c398*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0067.609] CloseHandle (hObject=0x15c) returned 1 [0067.609] WriteFile (in: hFile=0x228, lpBuffer=0x225a828*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x225a828*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0067.610] CloseHandle (hObject=0x228) returned 1 [0067.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js", lpFilePart=0x0) returned 0x85 [0067.610] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1 [0067.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0067.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", lpFilePart=0x0) returned 0x86 [0067.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0067.611] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0067.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.627] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.631] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.631] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.631] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0067.631] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0067.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0067.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0067.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales", lpFilePart=0x0) returned 0x86 [0067.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0067.632] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0067.632] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.633] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.633] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.634] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.637] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0067.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0067.638] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0067.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0067.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0067.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0067.639] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.641] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0067.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0067.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.642] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.643] GetFileType (hFile=0x228) returned 0x1 [0067.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.643] GetFileType (hFile=0x228) returned 0x1 [0067.643] WriteFile (in: hFile=0x228, lpBuffer=0x227c110*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227c110*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.643] CloseHandle (hObject=0x228) returned 1 [0067.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.644] GetFileType (hFile=0x228) returned 0x1 [0067.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.644] GetFileType (hFile=0x228) returned 0x1 [0067.644] WriteFile (in: hFile=0x228, lpBuffer=0x227d268*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x227d268*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0067.645] CloseHandle (hObject=0x228) returned 1 [0067.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.645] GetFileType (hFile=0x228) returned 0x1 [0067.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.646] GetFileType (hFile=0x228) returned 0x1 [0067.646] WriteFile (in: hFile=0x228, lpBuffer=0x2280fe8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2280fe8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0067.646] CloseHandle (hObject=0x228) returned 1 [0067.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.648] GetFileType (hFile=0x228) returned 0x1 [0067.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.648] GetFileType (hFile=0x228) returned 0x1 [0067.648] WriteFile (in: hFile=0x228, lpBuffer=0x2283b38*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2283b38*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0067.649] CloseHandle (hObject=0x228) returned 1 [0067.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0067.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0067.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.651] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0067.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0067.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.653] GetFileType (hFile=0x228) returned 0x1 [0067.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.653] GetFileType (hFile=0x228) returned 0x1 [0067.654] WriteFile (in: hFile=0x228, lpBuffer=0x2291538*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2291538*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.654] CloseHandle (hObject=0x228) returned 1 [0067.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.655] GetFileType (hFile=0x228) returned 0x1 [0067.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.655] GetFileType (hFile=0x228) returned 0x1 [0067.655] WriteFile (in: hFile=0x228, lpBuffer=0x2292690*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2292690*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0067.656] CloseHandle (hObject=0x228) returned 1 [0067.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.656] GetFileType (hFile=0x228) returned 0x1 [0067.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.656] GetFileType (hFile=0x228) returned 0x1 [0067.656] WriteFile (in: hFile=0x228, lpBuffer=0x2296410*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2296410*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0067.657] CloseHandle (hObject=0x228) returned 1 [0067.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.670] GetFileType (hFile=0x228) returned 0x1 [0067.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.670] GetFileType (hFile=0x228) returned 0x1 [0067.671] WriteFile (in: hFile=0x228, lpBuffer=0x2298f60*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2298f60*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0067.672] CloseHandle (hObject=0x228) returned 1 [0067.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0067.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0067.672] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.672] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.672] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.672] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.672] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0067.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0067.673] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.673] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.673] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.673] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.673] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.674] GetFileType (hFile=0x228) returned 0x1 [0067.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.674] GetFileType (hFile=0x228) returned 0x1 [0067.674] WriteFile (in: hFile=0x228, lpBuffer=0x22a6960*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a6960*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.675] CloseHandle (hObject=0x228) returned 1 [0067.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.675] GetFileType (hFile=0x228) returned 0x1 [0067.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.675] GetFileType (hFile=0x228) returned 0x1 [0067.675] WriteFile (in: hFile=0x228, lpBuffer=0x22a7ab8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22a7ab8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0067.676] CloseHandle (hObject=0x228) returned 1 [0067.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.676] GetFileType (hFile=0x228) returned 0x1 [0067.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.676] GetFileType (hFile=0x228) returned 0x1 [0067.677] WriteFile (in: hFile=0x228, lpBuffer=0x22ab838*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22ab838*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0067.677] CloseHandle (hObject=0x228) returned 1 [0067.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.685] GetFileType (hFile=0x228) returned 0x1 [0067.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.685] GetFileType (hFile=0x228) returned 0x1 [0067.685] WriteFile (in: hFile=0x228, lpBuffer=0x22ae388*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22ae388*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0067.686] CloseHandle (hObject=0x228) returned 1 [0067.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0067.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0067.686] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.687] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.687] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.687] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.687] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0067.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0067.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.688] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.688] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.688] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.688] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.691] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.693] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.693] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0067.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0067.701] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.701] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.701] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0067.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0067.702] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.702] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.702] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.702] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0067.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0067.719] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.719] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.720] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0067.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0067.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.720] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.720] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0067.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0067.728] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.729] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0067.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0067.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.729] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.734] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0067.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0067.742] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.742] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.742] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.742] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.743] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0067.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0067.743] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.743] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.743] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.743] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.743] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.743] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0067.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.png", lpFilePart=0x0) returned 0x95 [0067.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.746] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0067.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.746] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.746] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0067.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0067.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0067.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.750] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0067.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0067.750] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.750] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.751] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.751] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0067.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.png", lpFilePart=0x0) returned 0x95 [0067.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.753] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0067.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0067.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.758] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0067.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0067.758] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.759] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0067.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0067.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.760] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0067.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0067.770] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.770] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0067.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0067.771] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.771] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.771] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0067.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.png", lpFilePart=0x0) returned 0x96 [0067.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0067.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0067.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0067.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0067.785] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.786] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0067.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0067.786] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.786] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.786] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0067.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0067.800] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.800] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0067.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0067.800] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.801] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.801] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.801] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.801] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0067.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0067.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.817] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0067.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0067.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.818] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0067.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x93 [0067.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0067.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0067.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0067.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0067.824] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.824] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.824] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.824] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.824] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0067.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0067.825] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.825] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0067.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0067.840] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.841] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he", lpFilePart=0x0) returned 0x89 [0067.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\", lpFilePart=0x0) returned 0x8a [0067.841] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.841] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0067.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0067.849] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.850] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0067.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0067.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.850] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0067.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0067.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.868] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0067.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0067.869] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.869] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0067.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0067.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.882] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0067.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0067.883] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.883] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.883] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.883] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0067.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0067.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.898] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0067.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0067.898] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.898] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.898] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0067.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0067.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.912] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0067.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0067.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.913] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0067.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0067.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.922] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0067.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0067.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.922] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.927] WriteFile (in: hFile=0x228, lpBuffer=0x223f370*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x223f370*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.927] CloseHandle (hObject=0x228) returned 1 [0067.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.929] GetFileType (hFile=0x228) returned 0x1 [0067.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.929] GetFileType (hFile=0x228) returned 0x1 [0067.929] WriteFile (in: hFile=0x228, lpBuffer=0x22404c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22404c8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0067.930] CloseHandle (hObject=0x228) returned 1 [0067.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.930] GetFileType (hFile=0x228) returned 0x1 [0067.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.930] GetFileType (hFile=0x228) returned 0x1 [0067.930] WriteFile (in: hFile=0x228, lpBuffer=0x2244248*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2244248*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0067.931] CloseHandle (hObject=0x228) returned 1 [0067.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.943] GetFileType (hFile=0x228) returned 0x1 [0067.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.944] GetFileType (hFile=0x228) returned 0x1 [0067.944] WriteFile (in: hFile=0x228, lpBuffer=0x2246d98*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2246d98*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0067.944] CloseHandle (hObject=0x228) returned 1 [0067.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0067.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0067.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.945] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.945] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.945] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.945] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0067.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0067.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.946] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.947] GetFileType (hFile=0x228) returned 0x1 [0067.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.947] GetFileType (hFile=0x228) returned 0x1 [0067.948] WriteFile (in: hFile=0x228, lpBuffer=0x2254798*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2254798*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.949] CloseHandle (hObject=0x228) returned 1 [0067.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.949] GetFileType (hFile=0x228) returned 0x1 [0067.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.949] GetFileType (hFile=0x228) returned 0x1 [0067.949] WriteFile (in: hFile=0x228, lpBuffer=0x22558f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22558f0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0067.950] CloseHandle (hObject=0x228) returned 1 [0067.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.950] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.951] GetFileType (hFile=0x228) returned 0x1 [0067.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.951] GetFileType (hFile=0x228) returned 0x1 [0067.951] WriteFile (in: hFile=0x228, lpBuffer=0x2259670*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2259670*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0067.952] CloseHandle (hObject=0x228) returned 1 [0067.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.961] GetFileType (hFile=0x228) returned 0x1 [0067.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.961] GetFileType (hFile=0x228) returned 0x1 [0067.962] WriteFile (in: hFile=0x228, lpBuffer=0x225c1c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225c1c0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0067.963] CloseHandle (hObject=0x228) returned 1 [0067.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0067.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0067.963] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.964] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.964] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.964] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.964] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0067.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0067.964] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.964] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.965] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.966] GetFileType (hFile=0x228) returned 0x1 [0067.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.966] GetFileType (hFile=0x228) returned 0x1 [0067.966] WriteFile (in: hFile=0x228, lpBuffer=0x2269bc0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2269bc0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.967] CloseHandle (hObject=0x228) returned 1 [0067.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0067.967] GetFileType (hFile=0x228) returned 0x1 [0067.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0067.967] GetFileType (hFile=0x228) returned 0x1 [0067.967] WriteFile (in: hFile=0x228, lpBuffer=0x226ad18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x226ad18*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0067.968] CloseHandle (hObject=0x228) returned 1 [0067.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0067.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.969] GetFileType (hFile=0x228) returned 0x1 [0067.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.969] GetFileType (hFile=0x228) returned 0x1 [0067.969] WriteFile (in: hFile=0x228, lpBuffer=0x226ea98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x226ea98*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0067.970] CloseHandle (hObject=0x228) returned 1 [0067.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0067.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.994] GetFileType (hFile=0x228) returned 0x1 [0067.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.994] GetFileType (hFile=0x228) returned 0x1 [0067.994] WriteFile (in: hFile=0x228, lpBuffer=0x22715e8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22715e8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0067.995] CloseHandle (hObject=0x228) returned 1 [0067.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0067.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0067.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.996] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0067.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms", lpFilePart=0x0) returned 0x89 [0067.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\", lpFilePart=0x0) returned 0x8a [0067.996] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0067.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0067.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0067.996] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0067.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0067.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0067.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0067.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0067.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0067.997] GetFileType (hFile=0x228) returned 0x1 [0067.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0067.997] GetFileType (hFile=0x228) returned 0x1 [0067.998] WriteFile (in: hFile=0x228, lpBuffer=0x227efe8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227efe8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0067.998] CloseHandle (hObject=0x228) returned 1 [0067.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.png", lpFilePart=0x0) returned 0x92 [0067.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0067.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.000] GetFileType (hFile=0x228) returned 0x1 [0068.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.000] GetFileType (hFile=0x228) returned 0x1 [0068.000] WriteFile (in: hFile=0x228, lpBuffer=0x2280140*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2280140*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0068.001] CloseHandle (hObject=0x228) returned 1 [0068.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0068.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.002] GetFileType (hFile=0x228) returned 0x1 [0068.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.002] GetFileType (hFile=0x228) returned 0x1 [0068.002] WriteFile (in: hFile=0x228, lpBuffer=0x2283ec0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2283ec0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0068.003] CloseHandle (hObject=0x228) returned 1 [0068.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0068.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.019] GetFileType (hFile=0x228) returned 0x1 [0068.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.019] GetFileType (hFile=0x228) returned 0x1 [0068.019] WriteFile (in: hFile=0x228, lpBuffer=0x2286a10*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2286a10*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0068.020] CloseHandle (hObject=0x228) returned 1 [0068.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0068.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0068.020] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.021] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.021] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.021] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.021] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0068.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0068.021] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.022] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.022] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.022] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.022] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0068.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.023] GetFileType (hFile=0x228) returned 0x1 [0068.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.023] GetFileType (hFile=0x228) returned 0x1 [0068.023] WriteFile (in: hFile=0x228, lpBuffer=0x2294410*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2294410*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0068.024] CloseHandle (hObject=0x228) returned 1 [0068.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x92 [0068.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.024] GetFileType (hFile=0x228) returned 0x1 [0068.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.025] GetFileType (hFile=0x228) returned 0x1 [0068.025] WriteFile (in: hFile=0x228, lpBuffer=0x2295568*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2295568*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0068.057] CloseHandle (hObject=0x228) returned 1 [0068.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0068.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.058] GetFileType (hFile=0x228) returned 0x1 [0068.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.058] GetFileType (hFile=0x228) returned 0x1 [0068.058] WriteFile (in: hFile=0x228, lpBuffer=0x22992e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22992e8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0068.059] CloseHandle (hObject=0x228) returned 1 [0068.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0068.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.092] GetFileType (hFile=0x228) returned 0x1 [0068.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.092] GetFileType (hFile=0x228) returned 0x1 [0068.092] WriteFile (in: hFile=0x228, lpBuffer=0x229be38*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229be38*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0068.093] CloseHandle (hObject=0x228) returned 1 [0068.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0068.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0068.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.093] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.093] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.093] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.093] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0068.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0068.094] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.094] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0068.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.095] GetFileType (hFile=0x228) returned 0x1 [0068.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.095] GetFileType (hFile=0x228) returned 0x1 [0068.095] WriteFile (in: hFile=0x228, lpBuffer=0x22a9838*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a9838*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0068.096] CloseHandle (hObject=0x228) returned 1 [0068.096] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.png", lpFilePart=0x0) returned 0x92 [0068.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.097] GetFileType (hFile=0x228) returned 0x1 [0068.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.097] GetFileType (hFile=0x228) returned 0x1 [0068.097] WriteFile (in: hFile=0x228, lpBuffer=0x22aa990*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22aa990*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0068.098] CloseHandle (hObject=0x228) returned 1 [0068.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0068.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.098] GetFileType (hFile=0x228) returned 0x1 [0068.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.098] GetFileType (hFile=0x228) returned 0x1 [0068.098] WriteFile (in: hFile=0x228, lpBuffer=0x22ae710*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22ae710*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0068.102] CloseHandle (hObject=0x228) returned 1 [0068.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0068.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.144] GetFileType (hFile=0x228) returned 0x1 [0068.144] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.144] GetFileType (hFile=0x228) returned 0x1 [0068.144] WriteFile (in: hFile=0x228, lpBuffer=0x22b1260*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b1260*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0068.145] CloseHandle (hObject=0x228) returned 1 [0068.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0068.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0068.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.149] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0068.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0068.149] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.150] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.150] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0068.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x92 [0068.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0068.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0068.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0068.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0068.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.177] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0068.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0068.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.178] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.178] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0068.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.png", lpFilePart=0x0) returned 0x95 [0068.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0068.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0068.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0068.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0068.245] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.245] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.245] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.246] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.246] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0068.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0068.246] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.246] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.246] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.246] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.246] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0068.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.png", lpFilePart=0x0) returned 0x95 [0068.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0068.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0068.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0068.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0068.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.294] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.295] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.295] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.295] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0068.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.295] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.296] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.333] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.333] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.333] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.334] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.334] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.357] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.357] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.358] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.358] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.414] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.414] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.440] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.441] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.441] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.441] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.442] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.442] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.442] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.443] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.443] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.475] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.476] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.476] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.476] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.477] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.486] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.486] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.487] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.501] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.501] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.501] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.518] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.519] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.519] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.519] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.519] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.519] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.519] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.520] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0068.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0068.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0068.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0068.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.533] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0068.533] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.533] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.533] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0068.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.542] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.542] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.542] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.542] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.542] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.543] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.543] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.543] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.543] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.552] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.552] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.553] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0068.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0068.553] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0068.553] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.576] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0068.576] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.576] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0068.576] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0068.576] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0068.613] WriteFile (in: hFile=0x228, lpBuffer=0x223b1c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x223b1c0*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0068.614] CloseHandle (hObject=0x228) returned 1 [0068.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x77 [0068.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x78 [0068.614] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0068.625] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0068.625] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0068.625] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0068.626] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0068.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0068.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0068.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi", lpFilePart=0x0) returned 0x77 [0068.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\", lpFilePart=0x0) returned 0x78 [0068.626] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0068.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0068.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0068.626] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0068.626] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0068.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0068.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0068.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x7d [0068.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", lpFilePart=0x0) returned 0x7e [0068.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0068.635] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.636] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0068.636] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0068.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0068.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0068.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0", lpFilePart=0x0) returned 0x7d [0068.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\", lpFilePart=0x0) returned 0x7e [0068.637] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0068.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.638] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.639] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0068.640] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0068.640] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0068.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0068.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0068.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x85 [0068.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", dwFileAttributes=0x80) returned 1 [0068.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.Horsuke", lpFilePart=0x0) returned 0x8d [0068.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0068.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0068.642] GetFileType (hFile=0x228) returned 0x1 [0068.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0068.642] GetFileType (hFile=0x228) returned 0x1 [0069.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x85 [0069.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0069.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0069.468] GetFileType (hFile=0x15c) returned 0x1 [0069.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0069.468] GetFileType (hFile=0x15c) returned 0x1 [0069.468] ReadFile (in: hFile=0x15c, lpBuffer=0x232dcf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x232dcf8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0069.562] ReadFile (in: hFile=0x15c, lpBuffer=0x232dcf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x232dcf8*, lpNumberOfBytesRead=0x2edb68*=0x378, lpOverlapped=0x0) returned 1 [0069.623] ReadFile (in: hFile=0x15c, lpBuffer=0x232dcf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x232dcf8*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0069.623] CloseHandle (hObject=0x15c) returned 1 [0069.623] CloseHandle (hObject=0x228) returned 1 [0069.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png", lpFilePart=0x0) returned 0x85 [0069.623] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0069.624] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFilePart=0x0) returned 0x97 [0069.624] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", dwFileAttributes=0x80) returned 1 [0069.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.Horsuke", lpFilePart=0x0) returned 0x9f [0069.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0069.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0069.626] GetFileType (hFile=0x228) returned 0x1 [0069.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0069.626] GetFileType (hFile=0x228) returned 0x1 [0070.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFilePart=0x0) returned 0x97 [0070.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0070.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0070.228] GetFileType (hFile=0x15c) returned 0x1 [0070.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0070.228] GetFileType (hFile=0x15c) returned 0x1 [0070.228] ReadFile (in: hFile=0x15c, lpBuffer=0x2417d50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2417d50*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0070.263] WriteFile (in: hFile=0x228, lpBuffer=0x2416198*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2416198*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0070.264] ReadFile (in: hFile=0x15c, lpBuffer=0x2417d50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2417d50*, lpNumberOfBytesRead=0x2edb68*=0x103, lpOverlapped=0x0) returned 1 [0070.293] ReadFile (in: hFile=0x15c, lpBuffer=0x2417d50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2417d50*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0070.293] CloseHandle (hObject=0x15c) returned 1 [0070.293] WriteFile (in: hFile=0x228, lpBuffer=0x2416198*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2416198*, lpNumberOfBytesWritten=0x2eda38*=0x130, lpOverlapped=0x0) returned 1 [0070.293] CloseHandle (hObject=0x228) returned 1 [0070.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js", lpFilePart=0x0) returned 0x97 [0070.293] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1 [0070.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFilePart=0x0) returned 0x93 [0070.294] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", dwFileAttributes=0x80) returned 1 [0070.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.Horsuke", lpFilePart=0x0) returned 0x9b [0070.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0070.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0070.295] GetFileType (hFile=0x228) returned 0x1 [0070.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0070.296] GetFileType (hFile=0x228) returned 0x1 [0070.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFilePart=0x0) returned 0x93 [0070.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0070.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0070.799] GetFileType (hFile=0x15c) returned 0x1 [0070.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0070.799] GetFileType (hFile=0x15c) returned 0x1 [0070.799] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0070.804] WriteFile (in: hFile=0x228, lpBuffer=0x2300038*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2300038*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0070.805] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0070.810] WriteFile (in: hFile=0x228, lpBuffer=0x2300038*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2300038*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0070.810] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0070.810] WriteFile (in: hFile=0x228, lpBuffer=0x2300038*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2300038*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0070.811] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0070.811] WriteFile (in: hFile=0x228, lpBuffer=0x2300038*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2300038*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0070.811] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0070.811] WriteFile (in: hFile=0x228, lpBuffer=0x2300038*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2300038*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0070.811] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0xb6c, lpOverlapped=0x0) returned 1 [0070.812] ReadFile (in: hFile=0x15c, lpBuffer=0x2301b34, nNumberOfBytesToRead=0x94, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301b34*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0070.812] ReadFile (in: hFile=0x15c, lpBuffer=0x2301be0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2301be0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0070.812] CloseHandle (hObject=0x15c) returned 1 [0070.812] WriteFile (in: hFile=0x228, lpBuffer=0x2300038*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2300038*, lpNumberOfBytesWritten=0x2eda38*=0xb90, lpOverlapped=0x0) returned 1 [0070.812] CloseHandle (hObject=0x228) returned 1 [0070.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js", lpFilePart=0x0) returned 0x93 [0070.812] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1 [0070.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFilePart=0x0) returned 0x92 [0070.813] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", dwFileAttributes=0x80) returned 1 [0070.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.Horsuke", lpFilePart=0x0) returned 0x9a [0070.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0070.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0070.815] GetFileType (hFile=0x228) returned 0x1 [0070.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0070.815] GetFileType (hFile=0x228) returned 0x1 [0071.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFilePart=0x0) returned 0x92 [0071.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0071.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0071.262] GetFileType (hFile=0x15c) returned 0x1 [0071.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.262] GetFileType (hFile=0x15c) returned 0x1 [0071.262] ReadFile (in: hFile=0x15c, lpBuffer=0x23efee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23efee8*, lpNumberOfBytesRead=0x2edb68*=0xe0, lpOverlapped=0x0) returned 1 [0071.263] ReadFile (in: hFile=0x15c, lpBuffer=0x23efee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23efee8*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0071.264] CloseHandle (hObject=0x15c) returned 1 [0071.264] WriteFile (in: hFile=0x228, lpBuffer=0x23ee340*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x23ee340*, lpNumberOfBytesWritten=0x2eda38*=0x110, lpOverlapped=0x0) returned 1 [0071.265] CloseHandle (hObject=0x228) returned 1 [0071.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js", lpFilePart=0x0) returned 0x92 [0071.265] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1 [0071.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0071.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x86 [0071.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0071.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0071.267] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.269] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.270] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0071.277] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0071.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0071.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0071.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales", lpFilePart=0x0) returned 0x86 [0071.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0071.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0071.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0071.285] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0071.285] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0071.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0071.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x89 [0071.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", lpFilePart=0x0) returned 0x8a [0071.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.288] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af", lpFilePart=0x0) returned 0x89 [0071.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\", lpFilePart=0x0) returned 0x8a [0071.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.289] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.289] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.291] GetFileType (hFile=0x228) returned 0x1 [0071.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.291] GetFileType (hFile=0x228) returned 0x1 [0071.291] WriteFile (in: hFile=0x228, lpBuffer=0x2419a10*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2419a10*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.292] CloseHandle (hObject=0x228) returned 1 [0071.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.293] GetFileType (hFile=0x228) returned 0x1 [0071.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.293] GetFileType (hFile=0x228) returned 0x1 [0071.293] WriteFile (in: hFile=0x228, lpBuffer=0x241ab68*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x241ab68*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.294] CloseHandle (hObject=0x228) returned 1 [0071.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.294] GetFileType (hFile=0x228) returned 0x1 [0071.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.294] GetFileType (hFile=0x228) returned 0x1 [0071.294] WriteFile (in: hFile=0x228, lpBuffer=0x241e8e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x241e8e8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.295] CloseHandle (hObject=0x228) returned 1 [0071.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.310] GetFileType (hFile=0x228) returned 0x1 [0071.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.310] GetFileType (hFile=0x228) returned 0x1 [0071.310] WriteFile (in: hFile=0x228, lpBuffer=0x2421438*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2421438*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.311] CloseHandle (hObject=0x228) returned 1 [0071.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x89 [0071.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", lpFilePart=0x0) returned 0x8a [0071.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.311] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.311] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.311] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.312] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am", lpFilePart=0x0) returned 0x89 [0071.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\", lpFilePart=0x0) returned 0x8a [0071.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.312] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.312] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.312] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.312] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.313] GetFileType (hFile=0x228) returned 0x1 [0071.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.313] GetFileType (hFile=0x228) returned 0x1 [0071.313] WriteFile (in: hFile=0x228, lpBuffer=0x242ee38*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x242ee38*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.314] CloseHandle (hObject=0x228) returned 1 [0071.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.314] GetFileType (hFile=0x228) returned 0x1 [0071.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.314] GetFileType (hFile=0x228) returned 0x1 [0071.314] WriteFile (in: hFile=0x228, lpBuffer=0x242ff90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x242ff90*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.315] CloseHandle (hObject=0x228) returned 1 [0071.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.316] GetFileType (hFile=0x228) returned 0x1 [0071.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.316] GetFileType (hFile=0x228) returned 0x1 [0071.316] WriteFile (in: hFile=0x228, lpBuffer=0x2433d10*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2433d10*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.317] CloseHandle (hObject=0x228) returned 1 [0071.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.323] GetFileType (hFile=0x228) returned 0x1 [0071.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.323] GetFileType (hFile=0x228) returned 0x1 [0071.323] WriteFile (in: hFile=0x228, lpBuffer=0x2436860*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2436860*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.324] CloseHandle (hObject=0x228) returned 1 [0071.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0071.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0071.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.325] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0071.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0071.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.325] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.329] WriteFile (in: hFile=0x228, lpBuffer=0x224aec8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224aec8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.332] WriteFile (in: hFile=0x228, lpBuffer=0x224fda0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224fda0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.335] WriteFile (in: hFile=0x228, lpBuffer=0x22528f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22528f0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x89 [0071.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", lpFilePart=0x0) returned 0x8a [0071.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.336] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.336] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.337] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az", lpFilePart=0x0) returned 0x89 [0071.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\", lpFilePart=0x0) returned 0x8a [0071.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.337] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.338] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.340] GetFileType (hFile=0x228) returned 0x1 [0071.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.340] GetFileType (hFile=0x228) returned 0x1 [0071.340] WriteFile (in: hFile=0x228, lpBuffer=0x22602f0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22602f0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.341] CloseHandle (hObject=0x228) returned 1 [0071.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.342] GetFileType (hFile=0x228) returned 0x1 [0071.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.342] GetFileType (hFile=0x228) returned 0x1 [0071.342] WriteFile (in: hFile=0x228, lpBuffer=0x2261448*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2261448*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.343] CloseHandle (hObject=0x228) returned 1 [0071.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.343] GetFileType (hFile=0x228) returned 0x1 [0071.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.343] GetFileType (hFile=0x228) returned 0x1 [0071.343] WriteFile (in: hFile=0x228, lpBuffer=0x22651c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22651c8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.344] CloseHandle (hObject=0x228) returned 1 [0071.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.346] GetFileType (hFile=0x228) returned 0x1 [0071.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.346] GetFileType (hFile=0x228) returned 0x1 [0071.346] WriteFile (in: hFile=0x228, lpBuffer=0x2267d18*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2267d18*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.347] CloseHandle (hObject=0x228) returned 1 [0071.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0071.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0071.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.348] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0071.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0071.348] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.349] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.349] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.351] GetFileType (hFile=0x228) returned 0x1 [0071.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.351] GetFileType (hFile=0x228) returned 0x1 [0071.351] WriteFile (in: hFile=0x228, lpBuffer=0x2275718*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2275718*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.352] CloseHandle (hObject=0x228) returned 1 [0071.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.352] GetFileType (hFile=0x228) returned 0x1 [0071.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.353] GetFileType (hFile=0x228) returned 0x1 [0071.353] WriteFile (in: hFile=0x228, lpBuffer=0x2276870*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2276870*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.354] CloseHandle (hObject=0x228) returned 1 [0071.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.354] GetFileType (hFile=0x228) returned 0x1 [0071.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.354] GetFileType (hFile=0x228) returned 0x1 [0071.354] WriteFile (in: hFile=0x228, lpBuffer=0x227a5f0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x227a5f0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.355] CloseHandle (hObject=0x228) returned 1 [0071.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.368] GetFileType (hFile=0x228) returned 0x1 [0071.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.368] GetFileType (hFile=0x228) returned 0x1 [0071.368] WriteFile (in: hFile=0x228, lpBuffer=0x227d140*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227d140*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.369] CloseHandle (hObject=0x228) returned 1 [0071.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x89 [0071.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x8a [0071.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.370] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn", lpFilePart=0x0) returned 0x89 [0071.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x8a [0071.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.371] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.372] GetFileType (hFile=0x228) returned 0x1 [0071.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.372] GetFileType (hFile=0x228) returned 0x1 [0071.372] WriteFile (in: hFile=0x228, lpBuffer=0x228ab40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x228ab40*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.373] CloseHandle (hObject=0x228) returned 1 [0071.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.373] GetFileType (hFile=0x228) returned 0x1 [0071.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.373] GetFileType (hFile=0x228) returned 0x1 [0071.373] WriteFile (in: hFile=0x228, lpBuffer=0x228bc98*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x228bc98*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.374] CloseHandle (hObject=0x228) returned 1 [0071.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.375] GetFileType (hFile=0x228) returned 0x1 [0071.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.375] GetFileType (hFile=0x228) returned 0x1 [0071.375] WriteFile (in: hFile=0x228, lpBuffer=0x228fa18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x228fa18*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.376] CloseHandle (hObject=0x228) returned 1 [0071.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.405] GetFileType (hFile=0x228) returned 0x1 [0071.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.405] GetFileType (hFile=0x228) returned 0x1 [0071.405] WriteFile (in: hFile=0x228, lpBuffer=0x2292568*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2292568*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.406] CloseHandle (hObject=0x228) returned 1 [0071.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0071.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0071.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.407] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0071.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0071.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.408] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.408] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.408] GetFileType (hFile=0x228) returned 0x1 [0071.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.408] GetFileType (hFile=0x228) returned 0x1 [0071.409] WriteFile (in: hFile=0x228, lpBuffer=0x229ff68*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229ff68*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.409] CloseHandle (hObject=0x228) returned 1 [0071.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.410] GetFileType (hFile=0x228) returned 0x1 [0071.410] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.410] GetFileType (hFile=0x228) returned 0x1 [0071.410] WriteFile (in: hFile=0x228, lpBuffer=0x22a10c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22a10c0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.411] CloseHandle (hObject=0x228) returned 1 [0071.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.411] GetFileType (hFile=0x228) returned 0x1 [0071.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.411] GetFileType (hFile=0x228) returned 0x1 [0071.411] WriteFile (in: hFile=0x228, lpBuffer=0x22a4e40*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22a4e40*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.412] CloseHandle (hObject=0x228) returned 1 [0071.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.414] GetFileType (hFile=0x228) returned 0x1 [0071.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.414] GetFileType (hFile=0x228) returned 0x1 [0071.414] WriteFile (in: hFile=0x228, lpBuffer=0x22a7990*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a7990*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.415] CloseHandle (hObject=0x228) returned 1 [0071.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0071.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0071.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.416] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0071.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0071.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.416] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.417] GetFileType (hFile=0x228) returned 0x1 [0071.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.417] GetFileType (hFile=0x228) returned 0x1 [0071.417] WriteFile (in: hFile=0x228, lpBuffer=0x22b5390*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b5390*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.418] CloseHandle (hObject=0x228) returned 1 [0071.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.418] GetFileType (hFile=0x228) returned 0x1 [0071.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.418] GetFileType (hFile=0x228) returned 0x1 [0071.418] WriteFile (in: hFile=0x228, lpBuffer=0x22b64e8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22b64e8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.419] CloseHandle (hObject=0x228) returned 1 [0071.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.420] GetFileType (hFile=0x228) returned 0x1 [0071.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.420] GetFileType (hFile=0x228) returned 0x1 [0071.420] WriteFile (in: hFile=0x228, lpBuffer=0x22ba268*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22ba268*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.421] CloseHandle (hObject=0x228) returned 1 [0071.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.421] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.422] GetFileType (hFile=0x228) returned 0x1 [0071.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.422] GetFileType (hFile=0x228) returned 0x1 [0071.422] WriteFile (in: hFile=0x228, lpBuffer=0x22bcdb8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22bcdb8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.423] CloseHandle (hObject=0x228) returned 1 [0071.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0071.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0071.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.424] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0071.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0071.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.425] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.425] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.425] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.425] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.426] GetFileType (hFile=0x228) returned 0x1 [0071.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.426] GetFileType (hFile=0x228) returned 0x1 [0071.426] WriteFile (in: hFile=0x228, lpBuffer=0x22ca7b8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22ca7b8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.427] CloseHandle (hObject=0x228) returned 1 [0071.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.427] GetFileType (hFile=0x228) returned 0x1 [0071.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.428] GetFileType (hFile=0x228) returned 0x1 [0071.428] WriteFile (in: hFile=0x228, lpBuffer=0x22cb910*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22cb910*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.428] CloseHandle (hObject=0x228) returned 1 [0071.429] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.429] GetFileType (hFile=0x228) returned 0x1 [0071.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.429] GetFileType (hFile=0x228) returned 0x1 [0071.429] WriteFile (in: hFile=0x228, lpBuffer=0x22cf690*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22cf690*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.430] CloseHandle (hObject=0x228) returned 1 [0071.430] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.434] GetFileType (hFile=0x228) returned 0x1 [0071.434] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.434] GetFileType (hFile=0x228) returned 0x1 [0071.434] WriteFile (in: hFile=0x228, lpBuffer=0x22d21e0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22d21e0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.435] CloseHandle (hObject=0x228) returned 1 [0071.435] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0071.435] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0071.435] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.436] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.436] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.436] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.436] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.436] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0071.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0071.436] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.436] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.436] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.436] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.437] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.437] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.441] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.441] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.441] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0071.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0071.444] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.445] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.445] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0071.445] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0071.445] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.446] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.446] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.447] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.449] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.450] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0071.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0071.455] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.455] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x8c [0071.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x8d [0071.456] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.456] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0071.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.png", lpFilePart=0x0) returned 0x95 [0071.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0071.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0071.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0071.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0071.463] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.464] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US", lpFilePart=0x0) returned 0x8c [0071.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\", lpFilePart=0x0) returned 0x8d [0071.464] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.464] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.464] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.464] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.464] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0071.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.png", lpFilePart=0x0) returned 0x95 [0071.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.466] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0071.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0071.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0071.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0071.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.471] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0071.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0071.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.471] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0071.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0071.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.479] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.479] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.479] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419", lpFilePart=0x0) returned 0x8d [0071.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x8e [0071.479] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.479] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.479] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.479] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.479] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0071.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.png", lpFilePart=0x0) returned 0x96 [0071.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0071.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0071.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0071.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0071.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.487] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et", lpFilePart=0x0) returned 0x89 [0071.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8a [0071.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.488] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x89 [0071.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8a [0071.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.503] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu", lpFilePart=0x0) returned 0x89 [0071.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\", lpFilePart=0x0) returned 0x8a [0071.503] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.503] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x89 [0071.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x8a [0071.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.510] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa", lpFilePart=0x0) returned 0x89 [0071.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x8a [0071.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.511] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0071.519] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0071.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.521] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.521] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0071.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0071.521] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.521] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.521] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.521] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.521] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0071.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0071.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.528] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0071.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0071.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.528] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0071.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x93 [0071.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0071.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0071.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0071.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0071.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.554] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0071.554] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0071.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.555] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.555] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.555] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.555] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.559] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x8c [0071.569] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", lpFilePart=0x0) returned 0x8d [0071.569] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.570] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.570] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.570] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.570] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA", lpFilePart=0x0) returned 0x8c [0071.570] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\", lpFilePart=0x0) returned 0x8d [0071.571] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.571] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.571] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.571] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.571] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.571] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0071.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.png", lpFilePart=0x0) returned 0x95 [0071.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0071.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0071.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x89 [0071.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", lpFilePart=0x0) returned 0x8a [0071.599] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.599] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl", lpFilePart=0x0) returned 0x89 [0071.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\", lpFilePart=0x0) returned 0x8a [0071.600] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.600] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x89 [0071.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x8a [0071.618] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.619] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.619] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.619] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.619] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu", lpFilePart=0x0) returned 0x89 [0071.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x8a [0071.619] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.620] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.620] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.620] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.620] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.627] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0071.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0071.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.628] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0071.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0071.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.628] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x89 [0071.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a [0071.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr", lpFilePart=0x0) returned 0x89 [0071.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a [0071.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.652] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0071.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0071.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0071.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0071.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.672] WriteFile (in: hFile=0x228, lpBuffer=0x224abd0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224abd0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.673] CloseHandle (hObject=0x228) returned 1 [0071.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.674] GetFileType (hFile=0x228) returned 0x1 [0071.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.674] GetFileType (hFile=0x228) returned 0x1 [0071.674] WriteFile (in: hFile=0x228, lpBuffer=0x224bd28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x224bd28*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.675] CloseHandle (hObject=0x228) returned 1 [0071.675] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.675] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.675] GetFileType (hFile=0x228) returned 0x1 [0071.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.675] GetFileType (hFile=0x228) returned 0x1 [0071.675] WriteFile (in: hFile=0x228, lpBuffer=0x224faa8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224faa8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.676] CloseHandle (hObject=0x228) returned 1 [0071.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.678] GetFileType (hFile=0x228) returned 0x1 [0071.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.678] GetFileType (hFile=0x228) returned 0x1 [0071.678] WriteFile (in: hFile=0x228, lpBuffer=0x22525f8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22525f8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.679] CloseHandle (hObject=0x228) returned 1 [0071.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x89 [0071.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", lpFilePart=0x0) returned 0x8a [0071.679] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.680] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.680] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy", lpFilePart=0x0) returned 0x89 [0071.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\", lpFilePart=0x0) returned 0x8a [0071.680] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.681] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.681] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.681] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.681] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.683] GetFileType (hFile=0x228) returned 0x1 [0071.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.684] GetFileType (hFile=0x228) returned 0x1 [0071.684] WriteFile (in: hFile=0x228, lpBuffer=0x225fff8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225fff8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.685] CloseHandle (hObject=0x228) returned 1 [0071.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.685] GetFileType (hFile=0x228) returned 0x1 [0071.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.685] GetFileType (hFile=0x228) returned 0x1 [0071.685] WriteFile (in: hFile=0x228, lpBuffer=0x2261150*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2261150*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.686] CloseHandle (hObject=0x228) returned 1 [0071.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.687] GetFileType (hFile=0x228) returned 0x1 [0071.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.687] GetFileType (hFile=0x228) returned 0x1 [0071.687] WriteFile (in: hFile=0x228, lpBuffer=0x2264ed0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2264ed0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.688] CloseHandle (hObject=0x228) returned 1 [0071.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.706] GetFileType (hFile=0x228) returned 0x1 [0071.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.706] GetFileType (hFile=0x228) returned 0x1 [0071.706] WriteFile (in: hFile=0x228, lpBuffer=0x2267a20*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2267a20*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.707] CloseHandle (hObject=0x228) returned 1 [0071.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0071.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0071.707] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.707] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.708] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.708] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.708] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.708] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0071.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0071.708] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.708] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.708] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.708] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.709] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.711] GetFileType (hFile=0x228) returned 0x1 [0071.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.711] GetFileType (hFile=0x228) returned 0x1 [0071.711] WriteFile (in: hFile=0x228, lpBuffer=0x2275420*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2275420*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.712] CloseHandle (hObject=0x228) returned 1 [0071.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.713] GetFileType (hFile=0x228) returned 0x1 [0071.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.713] GetFileType (hFile=0x228) returned 0x1 [0071.713] WriteFile (in: hFile=0x228, lpBuffer=0x2276578*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2276578*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.714] CloseHandle (hObject=0x228) returned 1 [0071.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.714] GetFileType (hFile=0x228) returned 0x1 [0071.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.714] GetFileType (hFile=0x228) returned 0x1 [0071.714] WriteFile (in: hFile=0x228, lpBuffer=0x227a2f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x227a2f8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.715] CloseHandle (hObject=0x228) returned 1 [0071.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.721] GetFileType (hFile=0x228) returned 0x1 [0071.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.722] GetFileType (hFile=0x228) returned 0x1 [0071.722] WriteFile (in: hFile=0x228, lpBuffer=0x227ce48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227ce48*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.722] CloseHandle (hObject=0x228) returned 1 [0071.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x89 [0071.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", lpFilePart=0x0) returned 0x8a [0071.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.723] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.724] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is", lpFilePart=0x0) returned 0x89 [0071.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\", lpFilePart=0x0) returned 0x8a [0071.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.725] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0071.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.725] GetFileType (hFile=0x228) returned 0x1 [0071.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.725] GetFileType (hFile=0x228) returned 0x1 [0071.726] WriteFile (in: hFile=0x228, lpBuffer=0x228a848*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x228a848*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.726] CloseHandle (hObject=0x228) returned 1 [0071.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.727] GetFileType (hFile=0x228) returned 0x1 [0071.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.727] GetFileType (hFile=0x228) returned 0x1 [0071.727] WriteFile (in: hFile=0x228, lpBuffer=0x228b9a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x228b9a0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.728] CloseHandle (hObject=0x228) returned 1 [0071.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0071.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.729] GetFileType (hFile=0x228) returned 0x1 [0071.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.729] GetFileType (hFile=0x228) returned 0x1 [0071.729] WriteFile (in: hFile=0x228, lpBuffer=0x228f720*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x228f720*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.730] CloseHandle (hObject=0x228) returned 1 [0071.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0071.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.736] GetFileType (hFile=0x228) returned 0x1 [0071.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.736] GetFileType (hFile=0x228) returned 0x1 [0071.736] WriteFile (in: hFile=0x228, lpBuffer=0x2292270*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2292270*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.737] CloseHandle (hObject=0x228) returned 1 [0071.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0071.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0071.737] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.737] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.738] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.738] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0071.738] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.738] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.739] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.739] GetFileType (hFile=0x228) returned 0x1 [0071.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.739] GetFileType (hFile=0x228) returned 0x1 [0071.740] WriteFile (in: hFile=0x228, lpBuffer=0x229fc70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229fc70*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.740] CloseHandle (hObject=0x228) returned 1 [0071.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.741] GetFileType (hFile=0x228) returned 0x1 [0071.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.741] GetFileType (hFile=0x228) returned 0x1 [0071.741] WriteFile (in: hFile=0x228, lpBuffer=0x22a0dc8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22a0dc8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.742] CloseHandle (hObject=0x228) returned 1 [0071.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.742] GetFileType (hFile=0x228) returned 0x1 [0071.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.742] GetFileType (hFile=0x228) returned 0x1 [0071.742] WriteFile (in: hFile=0x228, lpBuffer=0x22a4b48*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22a4b48*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.743] CloseHandle (hObject=0x228) returned 1 [0071.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.760] GetFileType (hFile=0x228) returned 0x1 [0071.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.760] GetFileType (hFile=0x228) returned 0x1 [0071.760] WriteFile (in: hFile=0x228, lpBuffer=0x22a7698*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a7698*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.761] CloseHandle (hObject=0x228) returned 1 [0071.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.761] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.762] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.762] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.762] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.762] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.763] GetFileType (hFile=0x228) returned 0x1 [0071.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.763] GetFileType (hFile=0x228) returned 0x1 [0071.764] WriteFile (in: hFile=0x228, lpBuffer=0x22b5098*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b5098*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0071.764] CloseHandle (hObject=0x228) returned 1 [0071.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.765] GetFileType (hFile=0x228) returned 0x1 [0071.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.765] GetFileType (hFile=0x228) returned 0x1 [0071.765] WriteFile (in: hFile=0x228, lpBuffer=0x22b61f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22b61f0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0071.766] CloseHandle (hObject=0x228) returned 1 [0071.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.766] GetFileType (hFile=0x228) returned 0x1 [0071.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.766] GetFileType (hFile=0x228) returned 0x1 [0071.767] WriteFile (in: hFile=0x228, lpBuffer=0x22b9f70*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22b9f70*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0071.767] CloseHandle (hObject=0x228) returned 1 [0071.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.773] GetFileType (hFile=0x228) returned 0x1 [0071.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.773] GetFileType (hFile=0x228) returned 0x1 [0071.773] WriteFile (in: hFile=0x228, lpBuffer=0x22bcac0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22bcac0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0071.774] CloseHandle (hObject=0x228) returned 1 [0071.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.774] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.774] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.775] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.775] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.775] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.775] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.775] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.775] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.775] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.780] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.791] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.791] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.792] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.792] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.792] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.792] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.792] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.792] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.792] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.793] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.798] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.799] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.800] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.816] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.817] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.817] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.818] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.826] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.826] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.826] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.826] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.826] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.827] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.827] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.827] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.827] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.841] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.842] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.842] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.842] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.843] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.857] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.858] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.858] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.859] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.859] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.859] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.859] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.859] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.867] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.867] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.867] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.868] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.868] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.868] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.874] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.875] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.875] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.875] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.876] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.886] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.893] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.894] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.894] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.909] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.910] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.910] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.910] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.910] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.918] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.918] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.918] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.919] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.919] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.919] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.919] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0071.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0071.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0071.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0071.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.930] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0071.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0071.930] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.931] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0071.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.937] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.937] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.937] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.937] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.946] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.946] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.965] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.966] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.966] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.966] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.966] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.982] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.982] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.983] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.983] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.989] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.989] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0071.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.995] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.995] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0071.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0071.996] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0071.996] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0071.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0071.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.png", lpFilePart=0x0) returned 0x92 [0071.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.002] WriteFile (in: hFile=0x228, lpBuffer=0x224ca78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x224ca78*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0072.003] CloseHandle (hObject=0x228) returned 1 [0072.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.043] GetFileType (hFile=0x228) returned 0x1 [0072.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.043] GetFileType (hFile=0x228) returned 0x1 [0072.044] WriteFile (in: hFile=0x228, lpBuffer=0x224f5c8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224f5c8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0072.051] CloseHandle (hObject=0x228) returned 1 [0072.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", lpFilePart=0x0) returned 0x89 [0072.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a [0072.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.052] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.052] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.052] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.052] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru", lpFilePart=0x0) returned 0x89 [0072.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a [0072.052] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.053] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.053] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.053] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.053] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.059] GetFileType (hFile=0x228) returned 0x1 [0072.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.059] GetFileType (hFile=0x228) returned 0x1 [0072.059] WriteFile (in: hFile=0x228, lpBuffer=0x225cfc8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225cfc8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0072.074] CloseHandle (hObject=0x228) returned 1 [0072.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.074] GetFileType (hFile=0x228) returned 0x1 [0072.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.074] GetFileType (hFile=0x228) returned 0x1 [0072.074] WriteFile (in: hFile=0x228, lpBuffer=0x225e120*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x225e120*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0072.075] CloseHandle (hObject=0x228) returned 1 [0072.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.076] GetFileType (hFile=0x228) returned 0x1 [0072.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.076] GetFileType (hFile=0x228) returned 0x1 [0072.076] WriteFile (in: hFile=0x228, lpBuffer=0x2261ea0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2261ea0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0072.077] CloseHandle (hObject=0x228) returned 1 [0072.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.176] GetFileType (hFile=0x228) returned 0x1 [0072.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.176] GetFileType (hFile=0x228) returned 0x1 [0072.176] WriteFile (in: hFile=0x228, lpBuffer=0x22649f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22649f0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0072.177] CloseHandle (hObject=0x228) returned 1 [0072.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", lpFilePart=0x0) returned 0x89 [0072.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\", lpFilePart=0x0) returned 0x8a [0072.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.177] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si", lpFilePart=0x0) returned 0x89 [0072.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\", lpFilePart=0x0) returned 0x8a [0072.178] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.178] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.178] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.178] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.178] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.180] GetFileType (hFile=0x228) returned 0x1 [0072.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.180] GetFileType (hFile=0x228) returned 0x1 [0072.181] WriteFile (in: hFile=0x228, lpBuffer=0x22723f0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22723f0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0072.182] CloseHandle (hObject=0x228) returned 1 [0072.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.182] GetFileType (hFile=0x228) returned 0x1 [0072.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.182] GetFileType (hFile=0x228) returned 0x1 [0072.182] WriteFile (in: hFile=0x228, lpBuffer=0x2273548*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2273548*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0072.183] CloseHandle (hObject=0x228) returned 1 [0072.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.184] GetFileType (hFile=0x228) returned 0x1 [0072.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.184] GetFileType (hFile=0x228) returned 0x1 [0072.184] WriteFile (in: hFile=0x228, lpBuffer=0x22772c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22772c8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0072.184] CloseHandle (hObject=0x228) returned 1 [0072.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.186] GetFileType (hFile=0x228) returned 0x1 [0072.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.186] GetFileType (hFile=0x228) returned 0x1 [0072.186] WriteFile (in: hFile=0x228, lpBuffer=0x2279e18*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2279e18*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0072.187] CloseHandle (hObject=0x228) returned 1 [0072.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", lpFilePart=0x0) returned 0x89 [0072.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a [0072.187] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.188] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.188] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.188] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.188] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk", lpFilePart=0x0) returned 0x89 [0072.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a [0072.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.189] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.189] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.189] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.189] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.190] GetFileType (hFile=0x228) returned 0x1 [0072.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.190] GetFileType (hFile=0x228) returned 0x1 [0072.190] WriteFile (in: hFile=0x228, lpBuffer=0x2287818*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2287818*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0072.191] CloseHandle (hObject=0x228) returned 1 [0072.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.192] GetFileType (hFile=0x228) returned 0x1 [0072.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.192] GetFileType (hFile=0x228) returned 0x1 [0072.192] WriteFile (in: hFile=0x228, lpBuffer=0x2288970*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2288970*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0072.193] CloseHandle (hObject=0x228) returned 1 [0072.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.193] GetFileType (hFile=0x228) returned 0x1 [0072.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.193] GetFileType (hFile=0x228) returned 0x1 [0072.193] WriteFile (in: hFile=0x228, lpBuffer=0x228c6f0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x228c6f0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0072.194] CloseHandle (hObject=0x228) returned 1 [0072.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.205] GetFileType (hFile=0x228) returned 0x1 [0072.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.205] GetFileType (hFile=0x228) returned 0x1 [0072.205] WriteFile (in: hFile=0x228, lpBuffer=0x228f240*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x228f240*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0072.206] CloseHandle (hObject=0x228) returned 1 [0072.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", lpFilePart=0x0) returned 0x89 [0072.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a [0072.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.207] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl", lpFilePart=0x0) returned 0x89 [0072.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a [0072.207] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.208] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.208] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.208] GetFileType (hFile=0x228) returned 0x1 [0072.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.208] GetFileType (hFile=0x228) returned 0x1 [0072.209] WriteFile (in: hFile=0x228, lpBuffer=0x229cc40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229cc40*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0072.209] CloseHandle (hObject=0x228) returned 1 [0072.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.210] GetFileType (hFile=0x228) returned 0x1 [0072.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.210] GetFileType (hFile=0x228) returned 0x1 [0072.210] WriteFile (in: hFile=0x228, lpBuffer=0x229dd98*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x229dd98*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0072.211] CloseHandle (hObject=0x228) returned 1 [0072.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.212] GetFileType (hFile=0x228) returned 0x1 [0072.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.212] GetFileType (hFile=0x228) returned 0x1 [0072.212] WriteFile (in: hFile=0x228, lpBuffer=0x22a1b18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22a1b18*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0072.212] CloseHandle (hObject=0x228) returned 1 [0072.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.216] GetFileType (hFile=0x228) returned 0x1 [0072.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.216] GetFileType (hFile=0x228) returned 0x1 [0072.216] WriteFile (in: hFile=0x228, lpBuffer=0x22a4668*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a4668*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0072.217] CloseHandle (hObject=0x228) returned 1 [0072.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0072.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0072.217] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.218] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.218] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.218] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.218] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0072.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0072.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.219] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.220] GetFileType (hFile=0x228) returned 0x1 [0072.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.220] GetFileType (hFile=0x228) returned 0x1 [0072.220] WriteFile (in: hFile=0x228, lpBuffer=0x22b2068*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b2068*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0072.221] CloseHandle (hObject=0x228) returned 1 [0072.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.221] GetFileType (hFile=0x228) returned 0x1 [0072.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.221] GetFileType (hFile=0x228) returned 0x1 [0072.221] WriteFile (in: hFile=0x228, lpBuffer=0x22b31c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22b31c0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0072.222] CloseHandle (hObject=0x228) returned 1 [0072.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.223] GetFileType (hFile=0x228) returned 0x1 [0072.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.223] GetFileType (hFile=0x228) returned 0x1 [0072.223] WriteFile (in: hFile=0x228, lpBuffer=0x22b6f40*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22b6f40*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0072.224] CloseHandle (hObject=0x228) returned 1 [0072.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.236] GetFileType (hFile=0x228) returned 0x1 [0072.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.236] GetFileType (hFile=0x228) returned 0x1 [0072.236] WriteFile (in: hFile=0x228, lpBuffer=0x22b9a90*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b9a90*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0072.237] CloseHandle (hObject=0x228) returned 1 [0072.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", lpFilePart=0x0) returned 0x89 [0072.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a [0072.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.238] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.238] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.238] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv", lpFilePart=0x0) returned 0x89 [0072.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\", lpFilePart=0x0) returned 0x8a [0072.238] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.238] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.238] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.238] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.238] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.239] GetFileType (hFile=0x228) returned 0x1 [0072.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.239] GetFileType (hFile=0x228) returned 0x1 [0072.240] WriteFile (in: hFile=0x228, lpBuffer=0x22c7490*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22c7490*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0072.240] CloseHandle (hObject=0x228) returned 1 [0072.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.241] GetFileType (hFile=0x228) returned 0x1 [0072.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.241] GetFileType (hFile=0x228) returned 0x1 [0072.241] WriteFile (in: hFile=0x228, lpBuffer=0x22c85e8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22c85e8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0072.242] CloseHandle (hObject=0x228) returned 1 [0072.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x89 [0072.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x8a [0072.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.248] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw", lpFilePart=0x0) returned 0x89 [0072.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\", lpFilePart=0x0) returned 0x8a [0072.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.249] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x89 [0072.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", lpFilePart=0x0) returned 0x8a [0072.255] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.256] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.256] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.256] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.256] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta", lpFilePart=0x0) returned 0x89 [0072.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\", lpFilePart=0x0) returned 0x8a [0072.256] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.256] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.256] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.256] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.257] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x89 [0072.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", lpFilePart=0x0) returned 0x8a [0072.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.264] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te", lpFilePart=0x0) returned 0x89 [0072.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\", lpFilePart=0x0) returned 0x8a [0072.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.265] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0072.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0072.271] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.271] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.272] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0072.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0072.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.272] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.272] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0072.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0072.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.280] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0072.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0072.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.281] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0072.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0072.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.288] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0072.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0072.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.288] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.289] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.289] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.289] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", lpFilePart=0x0) returned 0x89 [0072.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", lpFilePart=0x0) returned 0x8a [0072.299] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.299] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.299] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.299] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.300] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur", lpFilePart=0x0) returned 0x89 [0072.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\", lpFilePart=0x0) returned 0x8a [0072.300] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.300] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.300] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.300] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.300] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", lpFilePart=0x0) returned 0x89 [0072.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a [0072.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.321] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi", lpFilePart=0x0) returned 0x89 [0072.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a [0072.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.321] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c [0072.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d [0072.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.332] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c [0072.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d [0072.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.332] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0072.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.png", lpFilePart=0x0) returned 0x95 [0072.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0072.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0072.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", lpFilePart=0x0) returned 0x8c [0072.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", lpFilePart=0x0) returned 0x8d [0072.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.347] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.347] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK", lpFilePart=0x0) returned 0x8c [0072.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\", lpFilePart=0x0) returned 0x8d [0072.347] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.348] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.348] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0072.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.png", lpFilePart=0x0) returned 0x95 [0072.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0072.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0072.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c [0072.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d [0072.362] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.363] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c [0072.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d [0072.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.364] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0072.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.png", lpFilePart=0x0) returned 0x95 [0072.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0072.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0072.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0072.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", lpFilePart=0x0) returned 0x89 [0072.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", lpFilePart=0x0) returned 0x8a [0072.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.370] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0072.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu", lpFilePart=0x0) returned 0x89 [0072.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\", lpFilePart=0x0) returned 0x8a [0072.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0072.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0072.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0072.371] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0072.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0072.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0072.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0072.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.png", lpFilePart=0x0) returned 0x92 [0072.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0072.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0072.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0072.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.TXT", lpFilePart=0x0) returned 0x8f [0072.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.png", lpFilePart=0x0) returned 0x8f [0072.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.vbs", lpFilePart=0x0) returned 0x8f [0072.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbb [0072.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", lpFilePart=0x0) returned 0x87 [0072.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", lpFilePart=0x0) returned 0x88 [0072.381] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0072.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0072.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0072.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0072.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0072.382] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata", lpFilePart=0x0) returned 0x87 [0072.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\", lpFilePart=0x0) returned 0x88 [0072.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0072.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0072.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0072.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0072.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0072.382] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.TXT", lpFilePart=0x0) returned 0x90 [0072.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.png", lpFilePart=0x0) returned 0x90 [0072.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.vbs", lpFilePart=0x0) returned 0x90 [0072.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbc [0072.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.TXT", lpFilePart=0x0) returned 0x86 [0072.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.png", lpFilePart=0x0) returned 0x86 [0072.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.vbs", lpFilePart=0x0) returned 0x86 [0072.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xb2 [0072.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.TXT", lpFilePart=0x0) returned 0x80 [0072.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.png", lpFilePart=0x0) returned 0x80 [0072.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.vbs", lpFilePart=0x0) returned 0x80 [0072.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xac [0072.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0072.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", lpFilePart=0x0) returned 0x77 [0072.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", lpFilePart=0x0) returned 0x78 [0072.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0072.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0072.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0072.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0072.409] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda", lpFilePart=0x0) returned 0x77 [0072.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\", lpFilePart=0x0) returned 0x78 [0072.409] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0072.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0072.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0072.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0072.410] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", lpFilePart=0x0) returned 0x81 [0072.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", lpFilePart=0x0) returned 0x82 [0072.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0072.417] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0", lpFilePart=0x0) returned 0x81 [0072.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\", lpFilePart=0x0) returned 0x82 [0072.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.419] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0072.419] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0072.419] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0072.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFilePart=0x0) returned 0x94 [0072.419] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", dwFileAttributes=0x80) returned 1 [0072.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.Horsuke", lpFilePart=0x0) returned 0x9c [0072.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFilePart=0x0) returned 0x94 [0072.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0072.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0072.885] GetFileType (hFile=0x15c) returned 0x1 [0072.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.886] GetFileType (hFile=0x15c) returned 0x1 [0072.886] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.891] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.892] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.904] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.905] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.905] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.905] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.906] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.906] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.906] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.906] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.906] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.906] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.907] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.907] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.907] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.907] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.908] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.908] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.908] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.909] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.909] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.909] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.910] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.910] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.911] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.911] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.911] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.913] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.913] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.913] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.913] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.913] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.914] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.914] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.914] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.914] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.914] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.914] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.915] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.915] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.915] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.915] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.915] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.915] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.916] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.916] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.916] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.916] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.916] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.916] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.917] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.917] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.917] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.917] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.917] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.917] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.918] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.919] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.919] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.919] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.919] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.919] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.919] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.920] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.920] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.920] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.920] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.920] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.920] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.921] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.921] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.921] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.921] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.921] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.921] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.922] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.922] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0072.922] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0072.922] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0xa2e, lpOverlapped=0x0) returned 1 [0072.922] ReadFile (in: hFile=0x15c, lpBuffer=0x230512e, nNumberOfBytesToRead=0x1d2, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x230512e*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0072.922] ReadFile (in: hFile=0x15c, lpBuffer=0x2305318, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2305318*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0072.922] CloseHandle (hObject=0x15c) returned 1 [0072.922] WriteFile (in: hFile=0x228, lpBuffer=0x2303770*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2303770*, lpNumberOfBytesWritten=0x2eda38*=0xa50, lpOverlapped=0x0) returned 1 [0072.923] CloseHandle (hObject=0x228) returned 1 [0072.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js", lpFilePart=0x0) returned 0x94 [0072.923] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1 [0072.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFilePart=0x0) returned 0x90 [0072.925] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", dwFileAttributes=0x80) returned 1 [0072.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.Horsuke", lpFilePart=0x0) returned 0x98 [0072.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0072.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0072.929] GetFileType (hFile=0x228) returned 0x1 [0072.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0072.929] GetFileType (hFile=0x228) returned 0x1 [0073.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFilePart=0x0) returned 0x90 [0073.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0073.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0073.417] GetFileType (hFile=0x15c) returned 0x1 [0073.417] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0073.417] GetFileType (hFile=0x15c) returned 0x1 [0073.417] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.421] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.422] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.430] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.431] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.431] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.431] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.432] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.433] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.433] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.433] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.433] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.433] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.433] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.434] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.435] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.435] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.435] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.435] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.435] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.436] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.436] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.436] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.436] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.437] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.438] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.438] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.438] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.438] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.438] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.438] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.439] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.440] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.441] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.441] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.441] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.441] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.441] WriteFile (in: hFile=0x228, lpBuffer=0x23fcab0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcab0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.441] ReadFile (in: hFile=0x15c, lpBuffer=0x23fe648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23fe648*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.443] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.444] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.445] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.446] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.447] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.447] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.448] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.448] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.448] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.448] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.449] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.449] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.449] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.449] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.449] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.450] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.451] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.451] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.451] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.451] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.451] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.451] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0073.452] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x1000, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2edaf8*=0x1000, lpOverlapped=0x0) returned 1 [0073.452] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x59, lpOverlapped=0x0) returned 1 [0073.452] ReadFile (in: hFile=0x15c, lpBuffer=0x2224fd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2224fd0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0073.452] CloseHandle (hObject=0x15c) returned 1 [0073.452] WriteFile (in: hFile=0x228, lpBuffer=0x22236d0*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x22236d0*, lpNumberOfBytesWritten=0x2eda38*=0x80, lpOverlapped=0x0) returned 1 [0073.452] CloseHandle (hObject=0x228) returned 1 [0073.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js", lpFilePart=0x0) returned 0x90 [0073.452] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1 [0073.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0073.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", lpFilePart=0x0) returned 0x85 [0073.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", lpFilePart=0x0) returned 0x86 [0073.454] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0073.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0073.455] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0073.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0073.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0073.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0073.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css", lpFilePart=0x0) returned 0x85 [0073.455] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\", lpFilePart=0x0) returned 0x86 [0073.455] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0073.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0073.456] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0073.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0073.456] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0073.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFilePart=0x0) returned 0x95 [0073.456] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", dwFileAttributes=0x80) returned 1 [0073.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.Horsuke", lpFilePart=0x0) returned 0x9d [0073.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0073.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0073.457] GetFileType (hFile=0x228) returned 0x1 [0073.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0073.457] GetFileType (hFile=0x228) returned 0x1 [0073.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFilePart=0x0) returned 0x95 [0073.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0073.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0073.923] GetFileType (hFile=0x15c) returned 0x1 [0073.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0073.923] GetFileType (hFile=0x15c) returned 0x1 [0073.923] ReadFile (in: hFile=0x15c, lpBuffer=0x2328d88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2328d88*, lpNumberOfBytesRead=0x2edae8*=0x6cd, lpOverlapped=0x0) returned 1 [0073.929] ReadFile (in: hFile=0x15c, lpBuffer=0x2328c3d, nNumberOfBytesToRead=0x133, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2328c3d*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0073.930] ReadFile (in: hFile=0x15c, lpBuffer=0x2328d88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2328d88*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0073.930] CloseHandle (hObject=0x15c) returned 1 [0073.930] WriteFile (in: hFile=0x228, lpBuffer=0x23271e8*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x23271e8*, lpNumberOfBytesWritten=0x2ed9b8*=0x6f0, lpOverlapped=0x0) returned 1 [0073.931] CloseHandle (hObject=0x228) returned 1 [0073.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css", lpFilePart=0x0) returned 0x95 [0073.931] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1 [0073.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.TXT", lpFilePart=0x0) returned 0x8e [0073.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0073.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0073.934] GetFileType (hFile=0x228) returned 0x1 [0073.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0073.934] GetFileType (hFile=0x228) returned 0x1 [0073.935] WriteFile (in: hFile=0x228, lpBuffer=0x2333a58*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x2333a58*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0073.935] CloseHandle (hObject=0x228) returned 1 [0073.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.png", lpFilePart=0x0) returned 0x8e [0073.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0073.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0073.936] GetFileType (hFile=0x228) returned 0x1 [0073.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0073.936] GetFileType (hFile=0x228) returned 0x1 [0073.936] WriteFile (in: hFile=0x228, lpBuffer=0x2334ba8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2334ba8*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0073.937] CloseHandle (hObject=0x228) returned 1 [0073.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.vbs", lpFilePart=0x0) returned 0x8e [0073.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0073.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0073.937] GetFileType (hFile=0x228) returned 0x1 [0073.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0073.937] GetFileType (hFile=0x228) returned 0x1 [0073.938] WriteFile (in: hFile=0x228, lpBuffer=0x2338910*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x2338910*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0073.938] CloseHandle (hObject=0x228) returned 1 [0073.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xba [0073.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0073.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0073.952] GetFileType (hFile=0x228) returned 0x1 [0073.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0073.952] GetFileType (hFile=0x228) returned 0x1 [0073.952] WriteFile (in: hFile=0x228, lpBuffer=0x233b450*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x233b450*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0073.953] CloseHandle (hObject=0x228) returned 1 [0073.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0073.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", lpFilePart=0x0) returned 0x86 [0073.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", lpFilePart=0x0) returned 0x87 [0073.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0073.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0073.954] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0073.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0073.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0073.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0073.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html", lpFilePart=0x0) returned 0x86 [0073.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\", lpFilePart=0x0) returned 0x87 [0073.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0073.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0073.955] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0073.955] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0073.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0073.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0073.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFilePart=0x0) returned 0x97 [0073.955] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", dwFileAttributes=0x80) returned 1 [0073.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.Horsuke", lpFilePart=0x0) returned 0x9f [0073.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0073.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0073.957] GetFileType (hFile=0x228) returned 0x1 [0073.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0073.957] GetFileType (hFile=0x228) returned 0x1 [0074.564] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFilePart=0x0) returned 0x97 [0074.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0074.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0074.565] GetFileType (hFile=0x15c) returned 0x1 [0074.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0074.565] GetFileType (hFile=0x15c) returned 0x1 [0074.565] ReadFile (in: hFile=0x15c, lpBuffer=0x2427c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2427c68*, lpNumberOfBytesRead=0x2edae8*=0x32a, lpOverlapped=0x0) returned 1 [0074.567] ReadFile (in: hFile=0x15c, lpBuffer=0x2427c68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2427c68*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0074.567] CloseHandle (hObject=0x15c) returned 1 [0074.568] WriteFile (in: hFile=0x228, lpBuffer=0x24260c0*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x24260c0*, lpNumberOfBytesWritten=0x2ed9b8*=0x350, lpOverlapped=0x0) returned 1 [0074.568] CloseHandle (hObject=0x228) returned 1 [0074.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html", lpFilePart=0x0) returned 0x97 [0074.568] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1 [0074.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.TXT", lpFilePart=0x0) returned 0x8f [0074.574] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0074.574] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0074.574] GetFileType (hFile=0x228) returned 0x1 [0074.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0074.574] GetFileType (hFile=0x228) returned 0x1 [0074.574] WriteFile (in: hFile=0x228, lpBuffer=0x2233770*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x2233770*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0074.575] CloseHandle (hObject=0x228) returned 1 [0074.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.png", lpFilePart=0x0) returned 0x8f [0074.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0074.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0074.576] GetFileType (hFile=0x228) returned 0x1 [0074.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0074.576] GetFileType (hFile=0x228) returned 0x1 [0074.576] WriteFile (in: hFile=0x228, lpBuffer=0x22348c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x22348c0*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0074.577] CloseHandle (hObject=0x228) returned 1 [0074.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.vbs", lpFilePart=0x0) returned 0x8f [0074.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0074.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0074.577] GetFileType (hFile=0x228) returned 0x1 [0074.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0074.577] GetFileType (hFile=0x228) returned 0x1 [0074.577] WriteFile (in: hFile=0x228, lpBuffer=0x2238628*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x2238628*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0074.578] CloseHandle (hObject=0x228) returned 1 [0074.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbb [0074.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0074.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0074.590] GetFileType (hFile=0x228) returned 0x1 [0074.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0074.590] GetFileType (hFile=0x228) returned 0x1 [0074.590] WriteFile (in: hFile=0x228, lpBuffer=0x223b168*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x223b168*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0074.591] CloseHandle (hObject=0x228) returned 1 [0074.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0074.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", lpFilePart=0x0) returned 0x88 [0074.591] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", lpFilePart=0x0) returned 0x89 [0074.591] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0074.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0074.642] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0074.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0074.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0074.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0074.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images", lpFilePart=0x0) returned 0x88 [0074.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\", lpFilePart=0x0) returned 0x89 [0074.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.644] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.645] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.645] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0074.645] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0074.645] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0074.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0074.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0074.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95 [0074.646] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", dwFileAttributes=0x80) returned 1 [0074.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.Horsuke", lpFilePart=0x0) returned 0x9d [0074.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0074.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0074.648] GetFileType (hFile=0x228) returned 0x1 [0074.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0074.648] GetFileType (hFile=0x228) returned 0x1 [0075.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95 [0075.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0075.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0075.136] GetFileType (hFile=0x15c) returned 0x1 [0075.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0075.136] GetFileType (hFile=0x15c) returned 0x1 [0075.136] ReadFile (in: hFile=0x15c, lpBuffer=0x232a4c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x232a4c8*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0075.144] ReadFile (in: hFile=0x15c, lpBuffer=0x232a4c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x232a4c8*, lpNumberOfBytesRead=0x2edae8*=0x109, lpOverlapped=0x0) returned 1 [0075.144] ReadFile (in: hFile=0x15c, lpBuffer=0x232a4c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x232a4c8*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0075.144] CloseHandle (hObject=0x15c) returned 1 [0075.144] CloseHandle (hObject=0x228) returned 1 [0075.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png", lpFilePart=0x0) returned 0x95 [0075.145] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0075.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94 [0075.145] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", dwFileAttributes=0x80) returned 1 [0075.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.Horsuke", lpFilePart=0x0) returned 0x9c [0075.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0075.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0075.147] GetFileType (hFile=0x228) returned 0x1 [0075.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0075.147] GetFileType (hFile=0x228) returned 0x1 [0075.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94 [0075.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0075.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0075.626] GetFileType (hFile=0x15c) returned 0x1 [0075.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0075.626] GetFileType (hFile=0x15c) returned 0x1 [0075.626] ReadFile (in: hFile=0x15c, lpBuffer=0x2414240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2414240*, lpNumberOfBytesRead=0x2edae8*=0x22c, lpOverlapped=0x0) returned 1 [0075.628] ReadFile (in: hFile=0x15c, lpBuffer=0x2414240, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2414240*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0075.628] CloseHandle (hObject=0x15c) returned 1 [0075.628] WriteFile (in: hFile=0x228, lpBuffer=0x24126a8*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x24126a8*, lpNumberOfBytesWritten=0x2ed9b8*=0x250, lpOverlapped=0x0) returned 1 [0075.629] CloseHandle (hObject=0x228) returned 1 [0075.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png", lpFilePart=0x0) returned 0x94 [0075.629] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3 [0075.630] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", dwFileAttributes=0x80) returned 1 [0075.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.Horsuke", lpFilePart=0x0) returned 0xab [0075.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0075.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0075.631] GetFileType (hFile=0x228) returned 0x1 [0075.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0075.631] GetFileType (hFile=0x228) returned 0x1 [0076.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3 [0076.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0076.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0076.257] GetFileType (hFile=0x15c) returned 0x1 [0076.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0076.257] GetFileType (hFile=0x15c) returned 0x1 [0076.257] ReadFile (in: hFile=0x15c, lpBuffer=0x22fd218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22fd218*, lpNumberOfBytesRead=0x2edae8*=0xa0, lpOverlapped=0x0) returned 1 [0076.258] ReadFile (in: hFile=0x15c, lpBuffer=0x22fd218, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22fd218*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0076.258] CloseHandle (hObject=0x15c) returned 1 [0076.258] WriteFile (in: hFile=0x228, lpBuffer=0x22fb648*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x22fb648*, lpNumberOfBytesWritten=0x2ed9b8*=0xd0, lpOverlapped=0x0) returned 1 [0076.259] CloseHandle (hObject=0x228) returned 1 [0076.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png", lpFilePart=0x0) returned 0xa3 [0076.259] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0076.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9 [0076.260] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", dwFileAttributes=0x80) returned 1 [0076.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.Horsuke", lpFilePart=0x0) returned 0xb1 [0076.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0076.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0076.262] GetFileType (hFile=0x228) returned 0x1 [0076.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0076.262] GetFileType (hFile=0x228) returned 0x1 [0076.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9 [0076.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0076.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0076.821] GetFileType (hFile=0x15c) returned 0x1 [0076.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0076.821] GetFileType (hFile=0x15c) returned 0x1 [0076.822] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23e6050*, lpNumberOfBytesRead=0x2edae8*=0xfc, lpOverlapped=0x0) returned 1 [0076.823] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23e6050*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0076.823] CloseHandle (hObject=0x15c) returned 1 [0076.823] WriteFile (in: hFile=0x228, lpBuffer=0x23e4460*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x23e4460*, lpNumberOfBytesWritten=0x2ed9b8*=0x120, lpOverlapped=0x0) returned 1 [0076.824] CloseHandle (hObject=0x228) returned 1 [0076.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png", lpFilePart=0x0) returned 0xa9 [0076.824] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0076.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9 [0076.825] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", dwFileAttributes=0x80) returned 1 [0076.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.Horsuke", lpFilePart=0x0) returned 0xb1 [0076.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0076.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0076.826] GetFileType (hFile=0x228) returned 0x1 [0076.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0076.826] GetFileType (hFile=0x228) returned 0x1 [0077.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9 [0077.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0077.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0077.419] GetFileType (hFile=0x15c) returned 0x1 [0077.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0077.419] GetFileType (hFile=0x15c) returned 0x1 [0077.420] ReadFile (in: hFile=0x15c, lpBuffer=0x22cef80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22cef80*, lpNumberOfBytesRead=0x2edae8*=0xa0, lpOverlapped=0x0) returned 1 [0077.421] ReadFile (in: hFile=0x15c, lpBuffer=0x22cef80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22cef80*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0077.421] CloseHandle (hObject=0x15c) returned 1 [0077.431] WriteFile (in: hFile=0x228, lpBuffer=0x22cd390*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x22cd390*, lpNumberOfBytesWritten=0x2ed9b8*=0xd0, lpOverlapped=0x0) returned 1 [0077.448] CloseHandle (hObject=0x228) returned 1 [0077.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png", lpFilePart=0x0) returned 0xa9 [0077.449] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0077.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac [0077.450] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", dwFileAttributes=0x80) returned 1 [0077.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.Horsuke", lpFilePart=0x0) returned 0xb4 [0077.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0077.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0077.452] GetFileType (hFile=0x228) returned 0x1 [0077.452] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0077.452] GetFileType (hFile=0x228) returned 0x1 [0077.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac [0077.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0077.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0077.967] GetFileType (hFile=0x15c) returned 0x1 [0077.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0077.967] GetFileType (hFile=0x15c) returned 0x1 [0077.967] ReadFile (in: hFile=0x15c, lpBuffer=0x23b7dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23b7dc8*, lpNumberOfBytesRead=0x2edae8*=0xa6, lpOverlapped=0x0) returned 1 [0077.968] ReadFile (in: hFile=0x15c, lpBuffer=0x23b7dc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23b7dc8*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0077.969] CloseHandle (hObject=0x15c) returned 1 [0077.969] WriteFile (in: hFile=0x228, lpBuffer=0x23b61d0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x23b61d0*, lpNumberOfBytesWritten=0x2ed9b8*=0xd0, lpOverlapped=0x0) returned 1 [0077.969] CloseHandle (hObject=0x228) returned 1 [0077.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png", lpFilePart=0x0) returned 0xac [0077.970] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0077.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab [0077.970] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", dwFileAttributes=0x80) returned 1 [0077.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.Horsuke", lpFilePart=0x0) returned 0xb3 [0077.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0077.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0077.972] GetFileType (hFile=0x228) returned 0x1 [0077.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0077.972] GetFileType (hFile=0x228) returned 0x1 [0078.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab [0078.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0078.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0078.572] GetFileType (hFile=0x15c) returned 0x1 [0078.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0078.572] GetFileType (hFile=0x15c) returned 0x1 [0078.572] ReadFile (in: hFile=0x15c, lpBuffer=0x22a0cd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22a0cd0*, lpNumberOfBytesRead=0x2edae8*=0xa0, lpOverlapped=0x0) returned 1 [0078.573] ReadFile (in: hFile=0x15c, lpBuffer=0x22a0cd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22a0cd0*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0078.573] CloseHandle (hObject=0x15c) returned 1 [0078.574] WriteFile (in: hFile=0x228, lpBuffer=0x229f0e0*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x229f0e0*, lpNumberOfBytesWritten=0x2ed9b8*=0xd0, lpOverlapped=0x0) returned 1 [0078.574] CloseHandle (hObject=0x228) returned 1 [0078.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png", lpFilePart=0x0) returned 0xab [0078.575] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0078.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.TXT", lpFilePart=0x0) returned 0x91 [0078.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0078.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.578] GetFileType (hFile=0x228) returned 0x1 [0078.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0078.578] GetFileType (hFile=0x228) returned 0x1 [0078.578] WriteFile (in: hFile=0x228, lpBuffer=0x22ab3a8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x22ab3a8*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0078.579] CloseHandle (hObject=0x228) returned 1 [0078.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.png", lpFilePart=0x0) returned 0x91 [0078.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0078.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.580] GetFileType (hFile=0x228) returned 0x1 [0078.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0078.580] GetFileType (hFile=0x228) returned 0x1 [0078.580] WriteFile (in: hFile=0x228, lpBuffer=0x22ac500*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x22ac500*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0078.581] CloseHandle (hObject=0x228) returned 1 [0078.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.vbs", lpFilePart=0x0) returned 0x91 [0078.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0078.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.581] GetFileType (hFile=0x228) returned 0x1 [0078.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0078.581] GetFileType (hFile=0x228) returned 0x1 [0078.581] WriteFile (in: hFile=0x228, lpBuffer=0x22b0280*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x22b0280*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0078.582] CloseHandle (hObject=0x228) returned 1 [0078.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbd [0078.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0078.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.583] GetFileType (hFile=0x228) returned 0x1 [0078.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0078.583] GetFileType (hFile=0x228) returned 0x1 [0078.583] WriteFile (in: hFile=0x228, lpBuffer=0x22b2dd0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x22b2dd0*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0078.583] CloseHandle (hObject=0x228) returned 1 [0078.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0078.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x8a [0078.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x8b [0078.584] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0078.590] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.590] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.590] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.590] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.591] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.592] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0078.595] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0078.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0078.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0078.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales", lpFilePart=0x0) returned 0x8a [0078.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\", lpFilePart=0x0) returned 0x8b [0078.596] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.597] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.598] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.599] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0078.600] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0078.600] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0078.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0078.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x8d [0078.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8e [0078.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.602] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg", lpFilePart=0x0) returned 0x8d [0078.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8e [0078.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.603] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.604] GetFileType (hFile=0x228) returned 0x1 [0078.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.604] GetFileType (hFile=0x228) returned 0x1 [0078.604] WriteFile (in: hFile=0x228, lpBuffer=0x22d2470*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22d2470*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.605] CloseHandle (hObject=0x228) returned 1 [0078.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.606] GetFileType (hFile=0x228) returned 0x1 [0078.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.606] GetFileType (hFile=0x228) returned 0x1 [0078.606] WriteFile (in: hFile=0x228, lpBuffer=0x22d35d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22d35d0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.608] CloseHandle (hObject=0x228) returned 1 [0078.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.608] GetFileType (hFile=0x228) returned 0x1 [0078.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.608] GetFileType (hFile=0x228) returned 0x1 [0078.608] WriteFile (in: hFile=0x228, lpBuffer=0x22d7368*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22d7368*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.609] CloseHandle (hObject=0x228) returned 1 [0078.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.639] GetFileType (hFile=0x228) returned 0x1 [0078.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.639] GetFileType (hFile=0x228) returned 0x1 [0078.639] WriteFile (in: hFile=0x228, lpBuffer=0x22d9ec8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22d9ec8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.640] CloseHandle (hObject=0x228) returned 1 [0078.640] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x8d [0078.640] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8e [0078.640] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.641] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.641] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca", lpFilePart=0x0) returned 0x8d [0078.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8e [0078.641] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.642] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.645] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.651] GetFileType (hFile=0x228) returned 0x1 [0078.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.651] GetFileType (hFile=0x228) returned 0x1 [0078.652] WriteFile (in: hFile=0x228, lpBuffer=0x22e79c8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22e79c8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.652] CloseHandle (hObject=0x228) returned 1 [0078.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.653] GetFileType (hFile=0x228) returned 0x1 [0078.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.653] GetFileType (hFile=0x228) returned 0x1 [0078.653] WriteFile (in: hFile=0x228, lpBuffer=0x22e8b28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22e8b28*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.654] CloseHandle (hObject=0x228) returned 1 [0078.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.655] GetFileType (hFile=0x228) returned 0x1 [0078.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.655] GetFileType (hFile=0x228) returned 0x1 [0078.655] WriteFile (in: hFile=0x228, lpBuffer=0x22ec8c0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22ec8c0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.656] CloseHandle (hObject=0x228) returned 1 [0078.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.667] GetFileType (hFile=0x228) returned 0x1 [0078.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.667] GetFileType (hFile=0x228) returned 0x1 [0078.667] WriteFile (in: hFile=0x228, lpBuffer=0x22ef420*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22ef420*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.668] CloseHandle (hObject=0x228) returned 1 [0078.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x8d [0078.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8e [0078.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.668] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs", lpFilePart=0x0) returned 0x8d [0078.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8e [0078.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.670] GetFileType (hFile=0x228) returned 0x1 [0078.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.670] GetFileType (hFile=0x228) returned 0x1 [0078.670] WriteFile (in: hFile=0x228, lpBuffer=0x22fcf20*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22fcf20*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.671] CloseHandle (hObject=0x228) returned 1 [0078.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.671] GetFileType (hFile=0x228) returned 0x1 [0078.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.672] GetFileType (hFile=0x228) returned 0x1 [0078.672] WriteFile (in: hFile=0x228, lpBuffer=0x22fe080*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22fe080*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.672] CloseHandle (hObject=0x228) returned 1 [0078.672] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.672] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.673] GetFileType (hFile=0x228) returned 0x1 [0078.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.673] GetFileType (hFile=0x228) returned 0x1 [0078.673] WriteFile (in: hFile=0x228, lpBuffer=0x2301e18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2301e18*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x8d [0078.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8e [0078.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.684] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da", lpFilePart=0x0) returned 0x8d [0078.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8e [0078.684] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.684] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.685] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.686] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x8d [0078.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8e [0078.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.697] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.697] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de", lpFilePart=0x0) returned 0x8d [0078.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8e [0078.697] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.698] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.698] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.698] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.698] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x8d [0078.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8e [0078.720] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.721] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el", lpFilePart=0x0) returned 0x8d [0078.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8e [0078.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.721] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.722] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.722] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.722] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x8d [0078.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8e [0078.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.740] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.741] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.741] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.741] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en", lpFilePart=0x0) returned 0x8d [0078.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8e [0078.741] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.741] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.741] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.741] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.741] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x90 [0078.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x91 [0078.748] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.748] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.748] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB", lpFilePart=0x0) returned 0x90 [0078.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\", lpFilePart=0x0) returned 0x91 [0078.749] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.749] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.749] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.TXT", lpFilePart=0x0) returned 0x99 [0078.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.png", lpFilePart=0x0) returned 0x99 [0078.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.vbs", lpFilePart=0x0) returned 0x99 [0078.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc5 [0078.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.753] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x8d [0078.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8e [0078.759] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.759] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.759] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es", lpFilePart=0x0) returned 0x8d [0078.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8e [0078.760] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.760] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.760] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.762] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x91 [0078.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x92 [0078.766] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.767] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419", lpFilePart=0x0) returned 0x91 [0078.767] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\", lpFilePart=0x0) returned 0x92 [0078.767] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.767] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.767] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.TXT", lpFilePart=0x0) returned 0x9a [0078.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.768] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.png", lpFilePart=0x0) returned 0x9a [0078.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.769] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.vbs", lpFilePart=0x0) returned 0x9a [0078.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc6 [0078.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x8d [0078.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8e [0078.781] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.781] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et", lpFilePart=0x0) returned 0x8d [0078.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\", lpFilePart=0x0) returned 0x8e [0078.781] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.781] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.782] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.782] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.784] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x8d [0078.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8e [0078.787] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.788] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi", lpFilePart=0x0) returned 0x8d [0078.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8e [0078.788] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.788] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.789] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.789] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.789] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.789] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.789] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x8e [0078.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8f [0078.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.797] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil", lpFilePart=0x0) returned 0x8e [0078.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8f [0078.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.797] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.797] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x97 [0078.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.797] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x97 [0078.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x97 [0078.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc3 [0078.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x8d [0078.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8e [0078.803] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.804] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr", lpFilePart=0x0) returned 0x8d [0078.804] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8e [0078.804] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.804] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.804] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.805] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.808] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x8d [0078.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8e [0078.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.819] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.819] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.820] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi", lpFilePart=0x0) returned 0x8d [0078.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8e [0078.820] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.820] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.820] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x8d [0078.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8e [0078.839] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.840] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.840] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr", lpFilePart=0x0) returned 0x8d [0078.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8e [0078.840] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.841] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.841] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x8d [0078.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8e [0078.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.860] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu", lpFilePart=0x0) returned 0x8d [0078.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8e [0078.860] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.860] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x8d [0078.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8e [0078.877] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.878] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id", lpFilePart=0x0) returned 0x8d [0078.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8e [0078.878] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.878] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.878] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.881] GetFileType (hFile=0x228) returned 0x1 [0078.881] GetFileType (hFile=0x228) returned 0x1 [0078.882] WriteFile (in: hFile=0x228, lpBuffer=0x2241720*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2241720*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.883] CloseHandle (hObject=0x228) returned 1 [0078.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.883] GetFileType (hFile=0x228) returned 0x1 [0078.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.883] GetFileType (hFile=0x228) returned 0x1 [0078.883] WriteFile (in: hFile=0x228, lpBuffer=0x2242880*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2242880*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.884] CloseHandle (hObject=0x228) returned 1 [0078.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.885] GetFileType (hFile=0x228) returned 0x1 [0078.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.885] GetFileType (hFile=0x228) returned 0x1 [0078.885] WriteFile (in: hFile=0x228, lpBuffer=0x2246618*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2246618*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.886] CloseHandle (hObject=0x228) returned 1 [0078.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.892] GetFileType (hFile=0x228) returned 0x1 [0078.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.892] GetFileType (hFile=0x228) returned 0x1 [0078.892] WriteFile (in: hFile=0x228, lpBuffer=0x2249178*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2249178*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.893] CloseHandle (hObject=0x228) returned 1 [0078.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x8d [0078.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8e [0078.893] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.894] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it", lpFilePart=0x0) returned 0x8d [0078.894] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8e [0078.894] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.894] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.895] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.895] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.897] GetFileType (hFile=0x228) returned 0x1 [0078.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.898] GetFileType (hFile=0x228) returned 0x1 [0078.898] WriteFile (in: hFile=0x228, lpBuffer=0x2256c78*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2256c78*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.899] CloseHandle (hObject=0x228) returned 1 [0078.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.899] GetFileType (hFile=0x228) returned 0x1 [0078.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.899] GetFileType (hFile=0x228) returned 0x1 [0078.899] WriteFile (in: hFile=0x228, lpBuffer=0x2257dd8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2257dd8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.900] CloseHandle (hObject=0x228) returned 1 [0078.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.901] GetFileType (hFile=0x228) returned 0x1 [0078.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.901] GetFileType (hFile=0x228) returned 0x1 [0078.901] WriteFile (in: hFile=0x228, lpBuffer=0x225bb70*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x225bb70*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.902] CloseHandle (hObject=0x228) returned 1 [0078.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.905] GetFileType (hFile=0x228) returned 0x1 [0078.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.906] GetFileType (hFile=0x228) returned 0x1 [0078.906] WriteFile (in: hFile=0x228, lpBuffer=0x225e6d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225e6d0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.907] CloseHandle (hObject=0x228) returned 1 [0078.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x8d [0078.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8e [0078.907] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.908] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.908] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja", lpFilePart=0x0) returned 0x8d [0078.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8e [0078.908] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.908] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.908] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.909] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.909] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.909] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.910] GetFileType (hFile=0x228) returned 0x1 [0078.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.910] GetFileType (hFile=0x228) returned 0x1 [0078.911] WriteFile (in: hFile=0x228, lpBuffer=0x226c1d0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x226c1d0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.912] CloseHandle (hObject=0x228) returned 1 [0078.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.912] GetFileType (hFile=0x228) returned 0x1 [0078.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.912] GetFileType (hFile=0x228) returned 0x1 [0078.913] WriteFile (in: hFile=0x228, lpBuffer=0x226d330*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x226d330*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.913] CloseHandle (hObject=0x228) returned 1 [0078.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.914] GetFileType (hFile=0x228) returned 0x1 [0078.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.914] GetFileType (hFile=0x228) returned 0x1 [0078.914] WriteFile (in: hFile=0x228, lpBuffer=0x22710c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22710c8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.915] CloseHandle (hObject=0x228) returned 1 [0078.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.920] GetFileType (hFile=0x228) returned 0x1 [0078.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.920] GetFileType (hFile=0x228) returned 0x1 [0078.920] WriteFile (in: hFile=0x228, lpBuffer=0x2273c28*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2273c28*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.920] CloseHandle (hObject=0x228) returned 1 [0078.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x8d [0078.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8e [0078.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.921] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.921] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.921] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.921] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko", lpFilePart=0x0) returned 0x8d [0078.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8e [0078.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.922] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.922] GetFileType (hFile=0x228) returned 0x1 [0078.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.923] GetFileType (hFile=0x228) returned 0x1 [0078.923] WriteFile (in: hFile=0x228, lpBuffer=0x2281728*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2281728*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.924] CloseHandle (hObject=0x228) returned 1 [0078.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.924] GetFileType (hFile=0x228) returned 0x1 [0078.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.924] GetFileType (hFile=0x228) returned 0x1 [0078.924] WriteFile (in: hFile=0x228, lpBuffer=0x2282888*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2282888*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.925] CloseHandle (hObject=0x228) returned 1 [0078.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.926] GetFileType (hFile=0x228) returned 0x1 [0078.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.926] GetFileType (hFile=0x228) returned 0x1 [0078.926] WriteFile (in: hFile=0x228, lpBuffer=0x2286620*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2286620*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.927] CloseHandle (hObject=0x228) returned 1 [0078.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.937] GetFileType (hFile=0x228) returned 0x1 [0078.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.937] GetFileType (hFile=0x228) returned 0x1 [0078.937] WriteFile (in: hFile=0x228, lpBuffer=0x2289180*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2289180*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.938] CloseHandle (hObject=0x228) returned 1 [0078.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x8d [0078.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8e [0078.938] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.939] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.939] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.939] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.939] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt", lpFilePart=0x0) returned 0x8d [0078.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8e [0078.939] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.940] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.940] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.940] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.940] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.941] GetFileType (hFile=0x228) returned 0x1 [0078.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.941] GetFileType (hFile=0x228) returned 0x1 [0078.941] WriteFile (in: hFile=0x228, lpBuffer=0x2296c80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2296c80*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.942] CloseHandle (hObject=0x228) returned 1 [0078.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.943] GetFileType (hFile=0x228) returned 0x1 [0078.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.943] GetFileType (hFile=0x228) returned 0x1 [0078.943] WriteFile (in: hFile=0x228, lpBuffer=0x2297de0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2297de0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.944] CloseHandle (hObject=0x228) returned 1 [0078.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.944] GetFileType (hFile=0x228) returned 0x1 [0078.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.944] GetFileType (hFile=0x228) returned 0x1 [0078.944] WriteFile (in: hFile=0x228, lpBuffer=0x229bb78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x229bb78*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.945] CloseHandle (hObject=0x228) returned 1 [0078.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.947] GetFileType (hFile=0x228) returned 0x1 [0078.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.947] GetFileType (hFile=0x228) returned 0x1 [0078.947] WriteFile (in: hFile=0x228, lpBuffer=0x229e6d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229e6d8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.948] CloseHandle (hObject=0x228) returned 1 [0078.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x8d [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8e [0078.948] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.948] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.948] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.948] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.948] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv", lpFilePart=0x0) returned 0x8d [0078.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8e [0078.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.949] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.949] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.949] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.949] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.950] GetFileType (hFile=0x228) returned 0x1 [0078.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.950] GetFileType (hFile=0x228) returned 0x1 [0078.950] WriteFile (in: hFile=0x228, lpBuffer=0x22ac1d8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22ac1d8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0078.951] CloseHandle (hObject=0x228) returned 1 [0078.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.951] GetFileType (hFile=0x228) returned 0x1 [0078.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.952] GetFileType (hFile=0x228) returned 0x1 [0078.952] WriteFile (in: hFile=0x228, lpBuffer=0x22ad338*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22ad338*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0078.952] CloseHandle (hObject=0x228) returned 1 [0078.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.953] GetFileType (hFile=0x228) returned 0x1 [0078.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.953] GetFileType (hFile=0x228) returned 0x1 [0078.953] WriteFile (in: hFile=0x228, lpBuffer=0x22b10d0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22b10d0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0078.954] CloseHandle (hObject=0x228) returned 1 [0078.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.955] GetFileType (hFile=0x228) returned 0x1 [0078.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.955] GetFileType (hFile=0x228) returned 0x1 [0078.956] WriteFile (in: hFile=0x228, lpBuffer=0x22b3c30*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b3c30*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0078.956] CloseHandle (hObject=0x228) returned 1 [0078.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x8d [0078.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x8e [0078.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.957] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.958] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb", lpFilePart=0x0) returned 0x8d [0078.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\", lpFilePart=0x0) returned 0x8e [0078.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.958] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.958] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.961] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x8d [0078.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8e [0078.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.967] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl", lpFilePart=0x0) returned 0x8d [0078.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8e [0078.968] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.968] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.968] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.968] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.968] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x8d [0078.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8e [0078.975] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.976] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.976] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl", lpFilePart=0x0) returned 0x8d [0078.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8e [0078.976] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.977] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0078.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x96 [0078.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0078.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0078.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x90 [0078.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x91 [0078.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.984] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x90 [0078.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x91 [0078.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.985] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.TXT", lpFilePart=0x0) returned 0x99 [0078.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.png", lpFilePart=0x0) returned 0x99 [0078.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.vbs", lpFilePart=0x0) returned 0x99 [0078.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc5 [0078.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x90 [0078.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x91 [0078.991] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.992] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.992] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.992] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.993] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0078.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x90 [0078.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x91 [0078.993] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0078.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0078.993] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0078.993] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0078.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0078.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0078.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.TXT", lpFilePart=0x0) returned 0x99 [0078.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.png", lpFilePart=0x0) returned 0x99 [0078.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0078.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0078.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0078.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.vbs", lpFilePart=0x0) returned 0x99 [0078.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0078.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc5 [0078.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0078.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0078.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x8d [0079.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8e [0079.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.000] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.001] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.001] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.001] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro", lpFilePart=0x0) returned 0x8d [0079.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8e [0079.001] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.001] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.001] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.001] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.001] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0079.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.png", lpFilePart=0x0) returned 0x96 [0079.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0079.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc2 [0079.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x8d [0079.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8e [0079.012] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.013] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.013] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.013] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.013] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru", lpFilePart=0x0) returned 0x8d [0079.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8e [0079.013] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.013] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.013] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.013] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.014] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.TXT", lpFilePart=0x0) returned 0x96 [0079.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.png", lpFilePart=0x0) returned 0x96 [0079.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.015] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.vbs", lpFilePart=0x0) returned 0x96 [0079.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.050] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.050] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.050] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.050] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.051] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.051] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.051] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.051] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.051] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.051] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.057] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.060] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.060] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.060] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.060] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.061] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.061] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.061] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.065] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.085] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.085] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.085] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.085] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.085] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.086] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.086] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.086] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.086] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.086] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.093] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.094] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.094] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.095] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.095] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.095] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.098] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.125] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.125] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.126] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.126] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.126] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.133] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.133] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.134] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.136] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.140] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.140] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.141] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.141] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.141] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.141] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.148] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.148] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.148] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.148] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.176] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.176] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.176] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.176] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.176] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.176] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.182] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.182] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0079.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.199] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.199] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0079.199] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.199] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0079.199] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.199] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.199] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0079.199] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.202] WriteFile (in: hFile=0x228, lpBuffer=0x223f410*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x223f410*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0079.203] CloseHandle (hObject=0x228) returned 1 [0079.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.png", lpFilePart=0x0) returned 0x94 [0079.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0079.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.203] GetFileType (hFile=0x228) returned 0x1 [0079.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0079.203] GetFileType (hFile=0x228) returned 0x1 [0079.203] WriteFile (in: hFile=0x228, lpBuffer=0x2240570*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2240570*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0079.204] CloseHandle (hObject=0x228) returned 1 [0079.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.vbs", lpFilePart=0x0) returned 0x94 [0079.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0079.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.205] GetFileType (hFile=0x228) returned 0x1 [0079.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0079.205] GetFileType (hFile=0x228) returned 0x1 [0079.205] WriteFile (in: hFile=0x228, lpBuffer=0x2244308*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x2244308*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0079.205] CloseHandle (hObject=0x228) returned 1 [0079.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc0 [0079.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0079.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.212] GetFileType (hFile=0x228) returned 0x1 [0079.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0079.212] GetFileType (hFile=0x228) returned 0x1 [0079.212] WriteFile (in: hFile=0x228, lpBuffer=0x2246e68*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x2246e68*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0079.213] CloseHandle (hObject=0x228) returned 1 [0079.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.TXT", lpFilePart=0x0) returned 0x8a [0079.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0079.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.218] GetFileType (hFile=0x228) returned 0x1 [0079.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0079.218] GetFileType (hFile=0x228) returned 0x1 [0079.218] WriteFile (in: hFile=0x228, lpBuffer=0x2251280*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x2251280*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0079.219] CloseHandle (hObject=0x228) returned 1 [0079.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.png", lpFilePart=0x0) returned 0x8a [0079.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.219] GetFileType (hFile=0x228) returned 0x1 [0079.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0079.219] GetFileType (hFile=0x228) returned 0x1 [0079.220] WriteFile (in: hFile=0x228, lpBuffer=0x22523c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22523c8*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0079.220] CloseHandle (hObject=0x228) returned 1 [0079.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.vbs", lpFilePart=0x0) returned 0x8a [0079.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0079.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.221] GetFileType (hFile=0x228) returned 0x1 [0079.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0079.221] GetFileType (hFile=0x228) returned 0x1 [0079.221] WriteFile (in: hFile=0x228, lpBuffer=0x2256118*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x2256118*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0079.222] CloseHandle (hObject=0x228) returned 1 [0079.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xb6 [0079.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0079.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.222] GetFileType (hFile=0x228) returned 0x1 [0079.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0079.222] GetFileType (hFile=0x228) returned 0x1 [0079.222] WriteFile (in: hFile=0x228, lpBuffer=0x2258c48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x2258c48*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0079.223] CloseHandle (hObject=0x228) returned 1 [0079.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.TXT", lpFilePart=0x0) returned 0x80 [0079.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0079.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.225] GetFileType (hFile=0x228) returned 0x1 [0079.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0079.226] GetFileType (hFile=0x228) returned 0x1 [0079.226] WriteFile (in: hFile=0x228, lpBuffer=0x2263040*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2263040*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0079.227] CloseHandle (hObject=0x228) returned 1 [0079.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.png", lpFilePart=0x0) returned 0x80 [0079.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0079.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.227] GetFileType (hFile=0x228) returned 0x1 [0079.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0079.227] GetFileType (hFile=0x228) returned 0x1 [0079.228] WriteFile (in: hFile=0x228, lpBuffer=0x2264178*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x2264178*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0079.228] CloseHandle (hObject=0x228) returned 1 [0079.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.vbs", lpFilePart=0x0) returned 0x80 [0079.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0079.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.230] GetFileType (hFile=0x228) returned 0x1 [0079.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0079.230] GetFileType (hFile=0x228) returned 0x1 [0079.230] WriteFile (in: hFile=0x228, lpBuffer=0x2267e98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x2267e98*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0079.231] CloseHandle (hObject=0x228) returned 1 [0079.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xac [0079.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0079.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.232] GetFileType (hFile=0x228) returned 0x1 [0079.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0079.232] GetFileType (hFile=0x228) returned 0x1 [0079.232] WriteFile (in: hFile=0x228, lpBuffer=0x226a9a8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x226a9a8*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0079.233] CloseHandle (hObject=0x228) returned 1 [0079.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0079.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x77 [0079.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x78 [0079.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0079.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0079.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0079.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0079.233] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0079.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0079.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0079.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia", lpFilePart=0x0) returned 0x77 [0079.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\", lpFilePart=0x0) returned 0x78 [0079.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0079.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0079.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0079.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0079.234] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0079.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0079.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0079.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", lpFilePart=0x0) returned 0x7d [0079.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", lpFilePart=0x0) returned 0x7e [0079.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0079.239] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.239] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.239] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.239] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.239] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.239] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0079.240] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0079.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0079.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0079.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0", lpFilePart=0x0) returned 0x7d [0079.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\", lpFilePart=0x0) returned 0x7e [0079.240] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0079.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0079.242] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0079.242] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0079.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0079.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85 [0079.242] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", dwFileAttributes=0x80) returned 1 [0079.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.Horsuke", lpFilePart=0x0) returned 0x8d [0079.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0079.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.245] GetFileType (hFile=0x228) returned 0x1 [0079.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.245] GetFileType (hFile=0x228) returned 0x1 [0079.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85 [0079.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0079.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0079.786] GetFileType (hFile=0x15c) returned 0x1 [0079.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.786] GetFileType (hFile=0x15c) returned 0x1 [0079.786] ReadFile (in: hFile=0x15c, lpBuffer=0x235adc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x235adc0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0079.805] ReadFile (in: hFile=0x15c, lpBuffer=0x235adc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x235adc0*, lpNumberOfBytesRead=0x2edb68*=0x80f, lpOverlapped=0x0) returned 1 [0079.806] ReadFile (in: hFile=0x15c, lpBuffer=0x235a9b7, nNumberOfBytesToRead=0x3f1, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x235a9b7*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0079.806] ReadFile (in: hFile=0x15c, lpBuffer=0x235adc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x235adc0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0079.806] CloseHandle (hObject=0x15c) returned 1 [0079.806] CloseHandle (hObject=0x228) returned 1 [0079.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png", lpFilePart=0x0) returned 0x85 [0079.806] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0079.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0079.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", lpFilePart=0x0) returned 0x86 [0079.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0079.807] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0079.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.815] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.816] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.817] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.818] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0079.818] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0079.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0079.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0079.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales", lpFilePart=0x0) returned 0x86 [0079.819] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\", lpFilePart=0x0) returned 0x87 [0079.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0079.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.821] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.822] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.823] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.824] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0079.824] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0079.824] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0079.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0079.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0079.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0079.825] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.831] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.831] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.831] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.831] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.831] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar", lpFilePart=0x0) returned 0x89 [0079.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x8a [0079.832] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.832] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.832] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.832] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.832] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.835] GetFileType (hFile=0x228) returned 0x1 [0079.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.835] GetFileType (hFile=0x228) returned 0x1 [0079.836] CloseHandle (hObject=0x228) returned 1 [0079.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.836] GetFileType (hFile=0x228) returned 0x1 [0079.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.836] GetFileType (hFile=0x228) returned 0x1 [0079.836] WriteFile (in: hFile=0x228, lpBuffer=0x237bd88*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x237bd88*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.837] CloseHandle (hObject=0x228) returned 1 [0079.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.838] GetFileType (hFile=0x228) returned 0x1 [0079.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.838] GetFileType (hFile=0x228) returned 0x1 [0079.839] CloseHandle (hObject=0x228) returned 1 [0079.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.847] GetFileType (hFile=0x228) returned 0x1 [0079.847] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.847] GetFileType (hFile=0x228) returned 0x1 [0079.848] CloseHandle (hObject=0x228) returned 1 [0079.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0079.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0079.849] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.849] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.849] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg", lpFilePart=0x0) returned 0x89 [0079.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x8a [0079.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.850] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.851] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.851] GetFileType (hFile=0x228) returned 0x1 [0079.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.852] GetFileType (hFile=0x228) returned 0x1 [0079.852] CloseHandle (hObject=0x228) returned 1 [0079.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.853] GetFileType (hFile=0x228) returned 0x1 [0079.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.853] GetFileType (hFile=0x228) returned 0x1 [0079.853] WriteFile (in: hFile=0x228, lpBuffer=0x23911b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x23911b0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.854] CloseHandle (hObject=0x228) returned 1 [0079.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.854] GetFileType (hFile=0x228) returned 0x1 [0079.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.854] GetFileType (hFile=0x228) returned 0x1 [0079.855] CloseHandle (hObject=0x228) returned 1 [0079.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.862] GetFileType (hFile=0x228) returned 0x1 [0079.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.862] GetFileType (hFile=0x228) returned 0x1 [0079.863] CloseHandle (hObject=0x228) returned 1 [0079.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0079.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0079.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.864] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.864] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.864] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.864] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca", lpFilePart=0x0) returned 0x89 [0079.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x8a [0079.864] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.865] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.865] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.865] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.865] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.866] GetFileType (hFile=0x228) returned 0x1 [0079.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.866] GetFileType (hFile=0x228) returned 0x1 [0079.867] CloseHandle (hObject=0x228) returned 1 [0079.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.867] GetFileType (hFile=0x228) returned 0x1 [0079.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.867] GetFileType (hFile=0x228) returned 0x1 [0079.867] WriteFile (in: hFile=0x228, lpBuffer=0x23a65d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x23a65d8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.868] CloseHandle (hObject=0x228) returned 1 [0079.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.869] GetFileType (hFile=0x228) returned 0x1 [0079.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.869] GetFileType (hFile=0x228) returned 0x1 [0079.870] CloseHandle (hObject=0x228) returned 1 [0079.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.871] GetFileType (hFile=0x228) returned 0x1 [0079.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.872] GetFileType (hFile=0x228) returned 0x1 [0079.872] CloseHandle (hObject=0x228) returned 1 [0079.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0079.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0079.872] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.873] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.873] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.873] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.874] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs", lpFilePart=0x0) returned 0x89 [0079.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x8a [0079.874] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.874] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.874] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.874] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.876] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0079.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0079.881] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.881] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.881] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.881] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.882] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da", lpFilePart=0x0) returned 0x89 [0079.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\", lpFilePart=0x0) returned 0x8a [0079.882] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.882] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.882] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.884] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0079.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0079.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.889] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de", lpFilePart=0x0) returned 0x89 [0079.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\", lpFilePart=0x0) returned 0x8a [0079.890] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.890] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.890] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.891] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0079.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0079.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.897] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el", lpFilePart=0x0) returned 0x89 [0079.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\", lpFilePart=0x0) returned 0x8a [0079.897] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.897] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.897] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", lpFilePart=0x0) returned 0x89 [0079.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8a [0079.911] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.911] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.911] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.911] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en", lpFilePart=0x0) returned 0x89 [0079.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\", lpFilePart=0x0) returned 0x8a [0079.912] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.912] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.914] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0079.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0079.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.921] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.921] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.921] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.921] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.921] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es", lpFilePart=0x0) returned 0x89 [0079.921] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\", lpFilePart=0x0) returned 0x8a [0079.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.922] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.922] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0079.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0079.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.929] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi", lpFilePart=0x0) returned 0x89 [0079.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x8a [0079.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.929] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.942] WriteFile (in: hFile=0x228, lpBuffer=0x2246d68*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2246d68*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0079.943] CloseHandle (hObject=0x228) returned 1 [0079.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0079.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0079.943] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.944] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.945] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.945] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.945] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil", lpFilePart=0x0) returned 0x8a [0079.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x8b [0079.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.946] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.946] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x93 [0079.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.950] GetFileType (hFile=0x228) returned 0x1 [0079.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.950] GetFileType (hFile=0x228) returned 0x1 [0079.950] WriteFile (in: hFile=0x228, lpBuffer=0x22547f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22547f8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0079.951] CloseHandle (hObject=0x228) returned 1 [0079.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x93 [0079.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.952] GetFileType (hFile=0x228) returned 0x1 [0079.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.952] GetFileType (hFile=0x228) returned 0x1 [0079.952] WriteFile (in: hFile=0x228, lpBuffer=0x2255950*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2255950*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.953] CloseHandle (hObject=0x228) returned 1 [0079.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x93 [0079.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.954] GetFileType (hFile=0x228) returned 0x1 [0079.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.954] GetFileType (hFile=0x228) returned 0x1 [0079.954] WriteFile (in: hFile=0x228, lpBuffer=0x22596d0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22596d0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0079.955] CloseHandle (hObject=0x228) returned 1 [0079.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbf [0079.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.957] GetFileType (hFile=0x228) returned 0x1 [0079.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.957] GetFileType (hFile=0x228) returned 0x1 [0079.957] WriteFile (in: hFile=0x228, lpBuffer=0x225c220*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225c220*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0079.958] CloseHandle (hObject=0x228) returned 1 [0079.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0079.958] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0079.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.959] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr", lpFilePart=0x0) returned 0x89 [0079.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x8a [0079.959] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.959] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.960] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.960] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.960] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.960] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.961] GetFileType (hFile=0x228) returned 0x1 [0079.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.961] GetFileType (hFile=0x228) returned 0x1 [0079.961] CloseHandle (hObject=0x228) returned 1 [0079.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.962] GetFileType (hFile=0x228) returned 0x1 [0079.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.962] GetFileType (hFile=0x228) returned 0x1 [0079.962] WriteFile (in: hFile=0x228, lpBuffer=0x226ad78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x226ad78*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.963] CloseHandle (hObject=0x228) returned 1 [0079.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.964] GetFileType (hFile=0x228) returned 0x1 [0079.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.964] GetFileType (hFile=0x228) returned 0x1 [0079.965] CloseHandle (hObject=0x228) returned 1 [0079.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.967] GetFileType (hFile=0x228) returned 0x1 [0079.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.967] GetFileType (hFile=0x228) returned 0x1 [0079.968] CloseHandle (hObject=0x228) returned 1 [0079.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0079.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0079.968] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.968] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.968] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.969] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.969] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi", lpFilePart=0x0) returned 0x89 [0079.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x8a [0079.969] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.969] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.969] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.969] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.969] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.970] GetFileType (hFile=0x228) returned 0x1 [0079.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.970] GetFileType (hFile=0x228) returned 0x1 [0079.971] CloseHandle (hObject=0x228) returned 1 [0079.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.972] GetFileType (hFile=0x228) returned 0x1 [0079.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.972] GetFileType (hFile=0x228) returned 0x1 [0079.972] WriteFile (in: hFile=0x228, lpBuffer=0x22801a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22801a0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.973] CloseHandle (hObject=0x228) returned 1 [0079.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.973] GetFileType (hFile=0x228) returned 0x1 [0079.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.973] GetFileType (hFile=0x228) returned 0x1 [0079.974] CloseHandle (hObject=0x228) returned 1 [0079.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.976] GetFileType (hFile=0x228) returned 0x1 [0079.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.976] GetFileType (hFile=0x228) returned 0x1 [0079.977] CloseHandle (hObject=0x228) returned 1 [0079.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x89 [0079.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a [0079.977] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.977] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0079.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr", lpFilePart=0x0) returned 0x89 [0079.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x8a [0079.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0079.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0079.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0079.978] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0079.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0079.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0079.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0079.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.979] GetFileType (hFile=0x228) returned 0x1 [0079.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.979] GetFileType (hFile=0x228) returned 0x1 [0079.980] CloseHandle (hObject=0x228) returned 1 [0079.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.png", lpFilePart=0x0) returned 0x92 [0079.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0079.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0079.980] GetFileType (hFile=0x228) returned 0x1 [0079.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0079.980] GetFileType (hFile=0x228) returned 0x1 [0079.980] WriteFile (in: hFile=0x228, lpBuffer=0x22955c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22955c8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0079.981] CloseHandle (hObject=0x228) returned 1 [0079.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0079.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0079.982] GetFileType (hFile=0x228) returned 0x1 [0079.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0079.982] GetFileType (hFile=0x228) returned 0x1 [0079.982] CloseHandle (hObject=0x228) returned 1 [0079.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0079.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0079.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.043] GetFileType (hFile=0x228) returned 0x1 [0080.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.043] GetFileType (hFile=0x228) returned 0x1 [0080.044] CloseHandle (hObject=0x228) returned 1 [0080.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0080.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0080.044] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.045] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu", lpFilePart=0x0) returned 0x89 [0080.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x8a [0080.045] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.045] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.046] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.046] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.046] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.047] GetFileType (hFile=0x228) returned 0x1 [0080.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.047] GetFileType (hFile=0x228) returned 0x1 [0080.056] CloseHandle (hObject=0x228) returned 1 [0080.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.056] GetFileType (hFile=0x228) returned 0x1 [0080.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.057] GetFileType (hFile=0x228) returned 0x1 [0080.057] WriteFile (in: hFile=0x228, lpBuffer=0x22aa9f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22aa9f0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0080.059] CloseHandle (hObject=0x228) returned 1 [0080.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.059] GetFileType (hFile=0x228) returned 0x1 [0080.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.059] GetFileType (hFile=0x228) returned 0x1 [0080.060] CloseHandle (hObject=0x228) returned 1 [0080.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.073] GetFileType (hFile=0x228) returned 0x1 [0080.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.074] GetFileType (hFile=0x228) returned 0x1 [0080.074] CloseHandle (hObject=0x228) returned 1 [0080.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0080.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0080.075] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.075] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id", lpFilePart=0x0) returned 0x89 [0080.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\", lpFilePart=0x0) returned 0x8a [0080.075] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.076] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.076] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.076] GetFileType (hFile=0x228) returned 0x1 [0080.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.077] GetFileType (hFile=0x228) returned 0x1 [0080.077] CloseHandle (hObject=0x228) returned 1 [0080.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.078] GetFileType (hFile=0x228) returned 0x1 [0080.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.078] GetFileType (hFile=0x228) returned 0x1 [0080.078] WriteFile (in: hFile=0x228, lpBuffer=0x22bfe18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22bfe18*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0080.079] CloseHandle (hObject=0x228) returned 1 [0080.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.079] GetFileType (hFile=0x228) returned 0x1 [0080.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.079] GetFileType (hFile=0x228) returned 0x1 [0080.080] CloseHandle (hObject=0x228) returned 1 [0080.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0080.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0080.082] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.083] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.083] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it", lpFilePart=0x0) returned 0x89 [0080.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\", lpFilePart=0x0) returned 0x8a [0080.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.084] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0080.090] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0080.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.091] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.091] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.091] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.091] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja", lpFilePart=0x0) returned 0x89 [0080.091] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x8a [0080.091] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.091] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.091] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.092] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.092] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.095] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0080.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0080.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.098] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.098] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.098] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.098] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko", lpFilePart=0x0) returned 0x89 [0080.098] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x8a [0080.098] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.098] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.099] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.099] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.099] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.101] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0080.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0080.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.111] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.111] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.111] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.111] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt", lpFilePart=0x0) returned 0x89 [0080.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x8a [0080.111] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.111] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.111] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.112] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.112] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.113] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0080.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0080.117] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.118] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.118] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.118] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.118] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv", lpFilePart=0x0) returned 0x89 [0080.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x8a [0080.118] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.118] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.118] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.118] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.119] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0080.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0080.126] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.127] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl", lpFilePart=0x0) returned 0x89 [0080.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\", lpFilePart=0x0) returned 0x8a [0080.127] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.127] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.127] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0080.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0080.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.136] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no", lpFilePart=0x0) returned 0x89 [0080.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\", lpFilePart=0x0) returned 0x8a [0080.136] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.137] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.140] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.141] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0080.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0080.146] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.146] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.147] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl", lpFilePart=0x0) returned 0x89 [0080.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\", lpFilePart=0x0) returned 0x8a [0080.147] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.147] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.147] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0080.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0080.155] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.156] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR", lpFilePart=0x0) returned 0x8c [0080.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\", lpFilePart=0x0) returned 0x8d [0080.156] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.156] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0080.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.png", lpFilePart=0x0) returned 0x95 [0080.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0080.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0080.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0080.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0080.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.165] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT", lpFilePart=0x0) returned 0x8c [0080.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\", lpFilePart=0x0) returned 0x8d [0080.165] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.165] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0080.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.png", lpFilePart=0x0) returned 0x95 [0080.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0080.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0080.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0080.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0080.174] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.175] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro", lpFilePart=0x0) returned 0x89 [0080.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\", lpFilePart=0x0) returned 0x8a [0080.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.175] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x89 [0080.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a [0080.184] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.185] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.185] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru", lpFilePart=0x0) returned 0x89 [0080.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\", lpFilePart=0x0) returned 0x8a [0080.185] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.185] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.185] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.185] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", lpFilePart=0x0) returned 0x89 [0080.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", lpFilePart=0x0) returned 0x8a [0080.194] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.195] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.195] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se", lpFilePart=0x0) returned 0x89 [0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\", lpFilePart=0x0) returned 0x8a [0080.195] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.195] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.195] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.195] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x89 [0080.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a [0080.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk", lpFilePart=0x0) returned 0x89 [0080.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\", lpFilePart=0x0) returned 0x8a [0080.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x89 [0080.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a [0080.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl", lpFilePart=0x0) returned 0x89 [0080.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\", lpFilePart=0x0) returned 0x8a [0080.215] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0080.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0080.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.224] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.224] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.225] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr", lpFilePart=0x0) returned 0x89 [0080.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\", lpFilePart=0x0) returned 0x8a [0080.225] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.225] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.225] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.225] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.225] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0080.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0080.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.234] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th", lpFilePart=0x0) returned 0x89 [0080.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\", lpFilePart=0x0) returned 0x8a [0080.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.234] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.234] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0080.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0080.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.249] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr", lpFilePart=0x0) returned 0x89 [0080.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\", lpFilePart=0x0) returned 0x8a [0080.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.249] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0080.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0080.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.281] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.282] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk", lpFilePart=0x0) returned 0x89 [0080.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\", lpFilePart=0x0) returned 0x8a [0080.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.282] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.285] WriteFile (in: hFile=0x228, lpBuffer=0x2251c78*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2251c78*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0080.286] CloseHandle (hObject=0x228) returned 1 [0080.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.287] GetFileType (hFile=0x228) returned 0x1 [0080.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.288] GetFileType (hFile=0x228) returned 0x1 [0080.288] WriteFile (in: hFile=0x228, lpBuffer=0x2252dd0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2252dd0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0080.289] CloseHandle (hObject=0x228) returned 1 [0080.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.289] GetFileType (hFile=0x228) returned 0x1 [0080.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.290] GetFileType (hFile=0x228) returned 0x1 [0080.290] WriteFile (in: hFile=0x228, lpBuffer=0x2256b50*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2256b50*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0080.290] CloseHandle (hObject=0x228) returned 1 [0080.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.293] GetFileType (hFile=0x228) returned 0x1 [0080.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.293] GetFileType (hFile=0x228) returned 0x1 [0080.293] WriteFile (in: hFile=0x228, lpBuffer=0x22596a0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22596a0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0080.294] CloseHandle (hObject=0x228) returned 1 [0080.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x89 [0080.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a [0080.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.294] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.294] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.295] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.295] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi", lpFilePart=0x0) returned 0x89 [0080.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\", lpFilePart=0x0) returned 0x8a [0080.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.295] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.296] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.296] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.TXT", lpFilePart=0x0) returned 0x92 [0080.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.299] GetFileType (hFile=0x228) returned 0x1 [0080.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.299] GetFileType (hFile=0x228) returned 0x1 [0080.299] WriteFile (in: hFile=0x228, lpBuffer=0x22670a0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22670a0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0080.300] CloseHandle (hObject=0x228) returned 1 [0080.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.png", lpFilePart=0x0) returned 0x92 [0080.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.301] GetFileType (hFile=0x228) returned 0x1 [0080.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.301] GetFileType (hFile=0x228) returned 0x1 [0080.301] WriteFile (in: hFile=0x228, lpBuffer=0x22681f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22681f8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0080.302] CloseHandle (hObject=0x228) returned 1 [0080.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.vbs", lpFilePart=0x0) returned 0x92 [0080.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.303] GetFileType (hFile=0x228) returned 0x1 [0080.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.303] GetFileType (hFile=0x228) returned 0x1 [0080.303] WriteFile (in: hFile=0x228, lpBuffer=0x226bf78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x226bf78*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0080.304] CloseHandle (hObject=0x228) returned 1 [0080.304] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbe [0080.304] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.306] GetFileType (hFile=0x228) returned 0x1 [0080.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.306] GetFileType (hFile=0x228) returned 0x1 [0080.306] WriteFile (in: hFile=0x228, lpBuffer=0x226eac8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x226eac8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0080.307] CloseHandle (hObject=0x228) returned 1 [0080.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c [0080.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d [0080.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.308] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN", lpFilePart=0x0) returned 0x8c [0080.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\", lpFilePart=0x0) returned 0x8d [0080.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.309] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0080.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.309] GetFileType (hFile=0x228) returned 0x1 [0080.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.309] GetFileType (hFile=0x228) returned 0x1 [0080.310] WriteFile (in: hFile=0x228, lpBuffer=0x227c5a8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227c5a8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0080.310] CloseHandle (hObject=0x228) returned 1 [0080.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.png", lpFilePart=0x0) returned 0x95 [0080.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.311] GetFileType (hFile=0x228) returned 0x1 [0080.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.311] GetFileType (hFile=0x228) returned 0x1 [0080.311] WriteFile (in: hFile=0x228, lpBuffer=0x227d708*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x227d708*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0080.312] CloseHandle (hObject=0x228) returned 1 [0080.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0080.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.312] GetFileType (hFile=0x228) returned 0x1 [0080.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.313] GetFileType (hFile=0x228) returned 0x1 [0080.313] WriteFile (in: hFile=0x228, lpBuffer=0x22814a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22814a0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0080.313] CloseHandle (hObject=0x228) returned 1 [0080.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0080.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.317] GetFileType (hFile=0x228) returned 0x1 [0080.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.317] GetFileType (hFile=0x228) returned 0x1 [0080.317] WriteFile (in: hFile=0x228, lpBuffer=0x2284000*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2284000*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0080.318] CloseHandle (hObject=0x228) returned 1 [0080.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c [0080.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d [0080.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.319] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW", lpFilePart=0x0) returned 0x8c [0080.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\", lpFilePart=0x0) returned 0x8d [0080.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0080.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0080.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0080.320] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0080.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0080.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.320] GetFileType (hFile=0x228) returned 0x1 [0080.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.321] GetFileType (hFile=0x228) returned 0x1 [0080.321] WriteFile (in: hFile=0x228, lpBuffer=0x2291ae0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2291ae0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0080.322] CloseHandle (hObject=0x228) returned 1 [0080.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.png", lpFilePart=0x0) returned 0x95 [0080.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0080.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.322] GetFileType (hFile=0x228) returned 0x1 [0080.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0080.322] GetFileType (hFile=0x228) returned 0x1 [0080.323] WriteFile (in: hFile=0x228, lpBuffer=0x2292c40*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2292c40*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0080.324] CloseHandle (hObject=0x228) returned 1 [0080.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0080.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.324] GetFileType (hFile=0x228) returned 0x1 [0080.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.324] GetFileType (hFile=0x228) returned 0x1 [0080.324] WriteFile (in: hFile=0x228, lpBuffer=0x22969d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22969d8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0080.325] CloseHandle (hObject=0x228) returned 1 [0080.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0080.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0080.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.327] GetFileType (hFile=0x228) returned 0x1 [0080.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0080.327] GetFileType (hFile=0x228) returned 0x1 [0080.327] WriteFile (in: hFile=0x228, lpBuffer=0x2299538*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2299538*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0080.328] CloseHandle (hObject=0x228) returned 1 [0080.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.TXT", lpFilePart=0x0) returned 0x8f [0080.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0080.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.330] GetFileType (hFile=0x228) returned 0x1 [0080.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0080.330] GetFileType (hFile=0x228) returned 0x1 [0080.330] WriteFile (in: hFile=0x228, lpBuffer=0x22a3960*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x22a3960*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0080.334] CloseHandle (hObject=0x228) returned 1 [0080.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.png", lpFilePart=0x0) returned 0x8f [0080.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0080.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.335] GetFileType (hFile=0x228) returned 0x1 [0080.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0080.335] GetFileType (hFile=0x228) returned 0x1 [0080.335] WriteFile (in: hFile=0x228, lpBuffer=0x22a4ab0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x22a4ab0*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0080.336] CloseHandle (hObject=0x228) returned 1 [0080.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.vbs", lpFilePart=0x0) returned 0x8f [0080.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0080.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.337] GetFileType (hFile=0x228) returned 0x1 [0080.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0080.337] GetFileType (hFile=0x228) returned 0x1 [0080.337] WriteFile (in: hFile=0x228, lpBuffer=0x22a8818*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x22a8818*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0080.338] CloseHandle (hObject=0x228) returned 1 [0080.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbb [0080.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0080.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.338] GetFileType (hFile=0x228) returned 0x1 [0080.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0080.339] GetFileType (hFile=0x228) returned 0x1 [0080.339] WriteFile (in: hFile=0x228, lpBuffer=0x22ab358*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x22ab358*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0080.339] CloseHandle (hObject=0x228) returned 1 [0080.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0080.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", lpFilePart=0x0) returned 0x87 [0080.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", lpFilePart=0x0) returned 0x88 [0080.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0080.340] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0080.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0080.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0080.341] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0080.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0080.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0080.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata", lpFilePart=0x0) returned 0x87 [0080.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\", lpFilePart=0x0) returned 0x88 [0080.341] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0080.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0080.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0080.341] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0080.342] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0080.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0080.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.TXT", lpFilePart=0x0) returned 0x90 [0080.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0080.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.342] GetFileType (hFile=0x228) returned 0x1 [0080.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0080.342] GetFileType (hFile=0x228) returned 0x1 [0080.343] WriteFile (in: hFile=0x228, lpBuffer=0x22b8d88*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x22b8d88*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0080.343] CloseHandle (hObject=0x228) returned 1 [0080.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.png", lpFilePart=0x0) returned 0x90 [0080.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0080.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.344] GetFileType (hFile=0x228) returned 0x1 [0080.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0080.344] GetFileType (hFile=0x228) returned 0x1 [0080.344] WriteFile (in: hFile=0x228, lpBuffer=0x22b9ee0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x22b9ee0*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0080.345] CloseHandle (hObject=0x228) returned 1 [0080.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.vbs", lpFilePart=0x0) returned 0x90 [0080.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0080.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.346] GetFileType (hFile=0x228) returned 0x1 [0080.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0080.346] GetFileType (hFile=0x228) returned 0x1 [0080.346] WriteFile (in: hFile=0x228, lpBuffer=0x22bdc60*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x22bdc60*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0080.347] CloseHandle (hObject=0x228) returned 1 [0080.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xbc [0080.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0080.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.349] GetFileType (hFile=0x228) returned 0x1 [0080.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0080.349] GetFileType (hFile=0x228) returned 0x1 [0080.349] WriteFile (in: hFile=0x228, lpBuffer=0x22c07b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x22c07b0*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0080.350] CloseHandle (hObject=0x228) returned 1 [0080.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.TXT", lpFilePart=0x0) returned 0x86 [0080.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0080.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.351] GetFileType (hFile=0x228) returned 0x1 [0080.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0080.351] GetFileType (hFile=0x228) returned 0x1 [0080.351] WriteFile (in: hFile=0x228, lpBuffer=0x22cabb8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x22cabb8*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0080.352] CloseHandle (hObject=0x228) returned 1 [0080.352] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.png", lpFilePart=0x0) returned 0x86 [0080.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0080.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.352] GetFileType (hFile=0x228) returned 0x1 [0080.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0080.353] GetFileType (hFile=0x228) returned 0x1 [0080.353] WriteFile (in: hFile=0x228, lpBuffer=0x22cbcf8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22cbcf8*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0080.353] CloseHandle (hObject=0x228) returned 1 [0080.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.vbs", lpFilePart=0x0) returned 0x86 [0080.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0080.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.354] GetFileType (hFile=0x228) returned 0x1 [0080.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0080.354] GetFileType (hFile=0x228) returned 0x1 [0080.354] WriteFile (in: hFile=0x228, lpBuffer=0x22cfa30*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x22cfa30*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0080.355] CloseHandle (hObject=0x228) returned 1 [0080.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xb2 [0080.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0080.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.356] GetFileType (hFile=0x228) returned 0x1 [0080.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0080.356] GetFileType (hFile=0x228) returned 0x1 [0080.356] WriteFile (in: hFile=0x228, lpBuffer=0x22d2550*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x22d2550*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0080.356] CloseHandle (hObject=0x228) returned 1 [0080.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.TXT", lpFilePart=0x0) returned 0x80 [0080.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0080.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.357] GetFileType (hFile=0x228) returned 0x1 [0080.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0080.357] GetFileType (hFile=0x228) returned 0x1 [0080.358] WriteFile (in: hFile=0x228, lpBuffer=0x22dc948*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22dc948*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0080.358] CloseHandle (hObject=0x228) returned 1 [0080.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.png", lpFilePart=0x0) returned 0x80 [0080.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0080.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.359] GetFileType (hFile=0x228) returned 0x1 [0080.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0080.359] GetFileType (hFile=0x228) returned 0x1 [0080.359] WriteFile (in: hFile=0x228, lpBuffer=0x22dda80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x22dda80*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0080.360] CloseHandle (hObject=0x228) returned 1 [0080.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.vbs", lpFilePart=0x0) returned 0x80 [0080.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0080.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0080.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xac [0080.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0080.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0080.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0080.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0080.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpFilePart=0x0) returned 0x77 [0080.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", lpFilePart=0x0) returned 0x78 [0080.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0080.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0080.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0080.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0080.366] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0080.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0080.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0080.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm", lpFilePart=0x0) returned 0x77 [0080.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\", lpFilePart=0x0) returned 0x78 [0080.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0080.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0080.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0080.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0080.367] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0080.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0080.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0080.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0", lpFilePart=0x0) returned 0x86 [0080.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0080.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.381] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0080.382] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0080.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0080.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0080.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0080.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0080.386] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0080.386] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0080.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0080.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0080.387] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", dwFileAttributes=0x80) returned 1 [0080.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0080.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFilePart=0x0) returned 0x91 [0080.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0080.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0080.837] GetFileType (hFile=0x15c) returned 0x1 [0080.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0080.837] GetFileType (hFile=0x15c) returned 0x1 [0080.837] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.859] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.862] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.863] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.863] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.863] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.863] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.864] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.864] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.864] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.864] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.865] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.865] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.865] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.865] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.866] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.867] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.867] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.868] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.868] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.868] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.868] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.869] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.869] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.869] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.869] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.870] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.870] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.870] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.870] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.871] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.871] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.871] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.871] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.871] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.872] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.872] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.872] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.872] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.873] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.873] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.873] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.873] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.873] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.874] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.874] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.874] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.875] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.875] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.876] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.876] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.876] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.876] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.877] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.877] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.877] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.877] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.878] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.878] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.878] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.878] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.879] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.879] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.879] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.879] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.880] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.880] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.880] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.881] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.881] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.881] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.881] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.882] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.882] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.882] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.882] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.883] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.883] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.883] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.885] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.885] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.885] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.886] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.886] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.886] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.886] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.887] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.887] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.887] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.887] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.888] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.888] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.888] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.888] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.889] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.889] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.889] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.889] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.890] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.890] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.890] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.890] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.890] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.891] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.891] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.891] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23d8538*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.893] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.893] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.894] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.894] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.894] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.895] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.895] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.895] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.895] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.896] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.896] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.896] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.896] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.897] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.897] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.897] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.897] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.897] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.898] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.898] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.898] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.898] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.898] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.899] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.899] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.900] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.900] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.900] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.900] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.901] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.901] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.901] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.901] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.901] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0080.902] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0xbf, lpOverlapped=0x0) returned 1 [0080.902] ReadFile (in: hFile=0x15c, lpBuffer=0x22463b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463b8*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0080.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js", lpFilePart=0x0) returned 0x91 [0080.902] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1 [0080.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFilePart=0x0) returned 0x9b [0080.906] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", dwFileAttributes=0x80) returned 1 [0080.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.Horsuke", lpFilePart=0x0) returned 0xa3 [0080.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0080.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0080.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0081.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFilePart=0x0) returned 0x9b [0081.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0081.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0081.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0081.342] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.358] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.358] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.358] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.359] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.359] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.359] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.359] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.359] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.360] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.360] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x89c, lpOverlapped=0x0) returned 1 [0081.360] ReadFile (in: hFile=0x15c, lpBuffer=0x234e254, nNumberOfBytesToRead=0x364, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e254*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0081.360] ReadFile (in: hFile=0x15c, lpBuffer=0x234e5d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x234e5d0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0081.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js", lpFilePart=0x0) returned 0x9b [0081.360] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1 [0081.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFilePart=0x0) returned 0x9a [0081.361] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", dwFileAttributes=0x80) returned 1 [0081.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.Horsuke", lpFilePart=0x0) returned 0xa2 [0081.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0081.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0081.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0081.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFilePart=0x0) returned 0x9a [0081.818] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0081.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0081.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0081.819] ReadFile (in: hFile=0x15c, lpBuffer=0x243ff68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x243ff68*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.822] ReadFile (in: hFile=0x15c, lpBuffer=0x243ff68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x243ff68*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.822] ReadFile (in: hFile=0x15c, lpBuffer=0x243ff68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x243ff68*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.822] ReadFile (in: hFile=0x15c, lpBuffer=0x243ff68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x243ff68*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.822] ReadFile (in: hFile=0x15c, lpBuffer=0x243ff68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x243ff68*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.824] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.824] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.824] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0081.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x1aa, lpOverlapped=0x0) returned 1 [0081.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463c8*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0081.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js", lpFilePart=0x0) returned 0x9a [0081.828] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1 [0081.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFilePart=0x0) returned 0x9e [0081.829] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", dwFileAttributes=0x80) returned 1 [0081.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.Horsuke", lpFilePart=0x0) returned 0xa6 [0081.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0081.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0081.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0082.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFilePart=0x0) returned 0x9e [0082.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0082.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0082.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0082.354] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.358] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.358] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.358] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.359] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.359] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.359] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.359] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.359] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.360] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.360] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.360] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.360] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.360] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.360] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x1e1, lpOverlapped=0x0) returned 1 [0082.361] ReadFile (in: hFile=0x15c, lpBuffer=0x233f5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x233f5b0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0082.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html", lpFilePart=0x0) returned 0x9e [0082.361] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1 [0082.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFilePart=0x0) returned 0x9c [0082.363] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", dwFileAttributes=0x80) returned 1 [0082.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.Horsuke", lpFilePart=0x0) returned 0xa4 [0082.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0082.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0082.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0082.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFilePart=0x0) returned 0x9c [0082.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0082.798] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0082.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0082.798] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.800] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.819] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.820] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.820] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.820] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.820] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.820] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.821] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.821] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.821] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.821] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.821] ReadFile (in: hFile=0x15c, lpBuffer=0x2437ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2437ba0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.823] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.824] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.824] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.824] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.825] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.826] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.827] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.828] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.829] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.829] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.829] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.829] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.829] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.830] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.830] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.830] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.830] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.831] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.831] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.831] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.831] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.831] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x258, lpOverlapped=0x0) returned 1 [0082.832] ReadFile (in: hFile=0x15c, lpBuffer=0x22463d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22463d0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0082.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js", lpFilePart=0x0) returned 0x9c [0082.833] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1 [0082.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFilePart=0x0) returned 0x95 [0082.835] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", dwFileAttributes=0x80) returned 1 [0082.836] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.Horsuke", lpFilePart=0x0) returned 0x9d [0082.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0082.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0082.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0083.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFilePart=0x0) returned 0x95 [0083.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0083.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0083.288] GetFileType (hFile=0x15c) returned 0x1 [0083.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0083.288] GetFileType (hFile=0x15c) returned 0x1 [0083.288] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.303] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.304] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.304] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.304] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.304] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.305] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.305] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.305] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.305] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.306] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.306] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.306] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0xe17, lpOverlapped=0x0) returned 1 [0083.306] ReadFile (in: hFile=0x15c, lpBuffer=0x23395bf, nNumberOfBytesToRead=0x1e9, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23395bf*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0083.306] ReadFile (in: hFile=0x15c, lpBuffer=0x23397c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23397c0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0083.306] CloseHandle (hObject=0x15c) returned 1 [0083.307] CloseHandle (hObject=0x228) returned 1 [0083.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js", lpFilePart=0x0) returned 0x95 [0083.307] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1 [0083.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFilePart=0x0) returned 0x90 [0083.308] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", dwFileAttributes=0x80) returned 1 [0083.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.Horsuke", lpFilePart=0x0) returned 0x98 [0083.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0083.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0083.309] GetFileType (hFile=0x228) returned 0x1 [0083.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0083.309] GetFileType (hFile=0x228) returned 0x1 [0083.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFilePart=0x0) returned 0x90 [0083.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0083.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0083.772] GetFileType (hFile=0x15c) returned 0x1 [0083.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0083.772] GetFileType (hFile=0x15c) returned 0x1 [0083.772] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.802] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.803] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.803] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.803] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.803] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.803] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.804] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.804] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.804] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.804] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.804] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0083.805] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x878, lpOverlapped=0x0) returned 1 [0083.805] ReadFile (in: hFile=0x15c, lpBuffer=0x222f400, nNumberOfBytesToRead=0x388, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f400*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0083.805] ReadFile (in: hFile=0x15c, lpBuffer=0x222f7a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222f7a0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0083.805] CloseHandle (hObject=0x15c) returned 1 [0083.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js", lpFilePart=0x0) returned 0x90 [0083.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1 [0083.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFilePart=0x0) returned 0x93 [0083.806] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", dwFileAttributes=0x80) returned 1 [0083.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.Horsuke", lpFilePart=0x0) returned 0x9b [0083.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0083.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0083.808] GetFileType (hFile=0x228) returned 0x1 [0083.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0083.808] GetFileType (hFile=0x228) returned 0x1 [0084.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFilePart=0x0) returned 0x93 [0084.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0084.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0084.350] GetFileType (hFile=0x15c) returned 0x1 [0084.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0084.350] GetFileType (hFile=0x15c) returned 0x1 [0084.350] ReadFile (in: hFile=0x15c, lpBuffer=0x2325120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2325120*, lpNumberOfBytesRead=0x2edb68*=0xc26, lpOverlapped=0x0) returned 1 [0084.360] ReadFile (in: hFile=0x15c, lpBuffer=0x2324d2e, nNumberOfBytesToRead=0x3da, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2324d2e*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0084.360] ReadFile (in: hFile=0x15c, lpBuffer=0x2325120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2325120*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0084.360] CloseHandle (hObject=0x15c) returned 1 [0084.361] WriteFile (in: hFile=0x228, lpBuffer=0x2323588*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x2323588*, lpNumberOfBytesWritten=0x2eda38*=0xc50, lpOverlapped=0x0) returned 1 [0084.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css", lpFilePart=0x0) returned 0x93 [0084.361] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1 [0084.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFilePart=0x0) returned 0x94 [0084.362] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", dwFileAttributes=0x80) returned 1 [0084.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.Horsuke", lpFilePart=0x0) returned 0x9c [0084.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0084.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0084.364] GetFileType (hFile=0x228) returned 0x1 [0084.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0084.364] GetFileType (hFile=0x228) returned 0x1 [0084.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFilePart=0x0) returned 0x94 [0084.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0084.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0084.815] GetFileType (hFile=0x15c) returned 0x1 [0084.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0084.815] GetFileType (hFile=0x15c) returned 0x1 [0084.815] ReadFile (in: hFile=0x15c, lpBuffer=0x240e9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240e9b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0084.831] ReadFile (in: hFile=0x15c, lpBuffer=0x240e9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240e9b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0084.831] ReadFile (in: hFile=0x15c, lpBuffer=0x240e9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240e9b8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0084.831] ReadFile (in: hFile=0x15c, lpBuffer=0x240e9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240e9b8*, lpNumberOfBytesRead=0x2edb68*=0x8a8, lpOverlapped=0x0) returned 1 [0084.831] ReadFile (in: hFile=0x15c, lpBuffer=0x240e648, nNumberOfBytesToRead=0x358, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240e648*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0084.832] ReadFile (in: hFile=0x15c, lpBuffer=0x240e9b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x240e9b8*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0084.832] CloseHandle (hObject=0x15c) returned 1 [0084.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html", lpFilePart=0x0) returned 0x94 [0084.832] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 1 [0084.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFilePart=0x0) returned 0x99 [0084.833] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", dwFileAttributes=0x80) returned 1 [0084.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.Horsuke", lpFilePart=0x0) returned 0xa1 [0084.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0084.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0084.835] GetFileType (hFile=0x228) returned 0x1 [0084.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0084.835] GetFileType (hFile=0x228) returned 0x1 [0085.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFilePart=0x0) returned 0x99 [0085.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0085.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0085.305] GetFileType (hFile=0x15c) returned 0x1 [0085.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0085.305] GetFileType (hFile=0x15c) returned 0x1 [0085.305] ReadFile (in: hFile=0x15c, lpBuffer=0x22fb118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22fb118*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.321] ReadFile (in: hFile=0x15c, lpBuffer=0x22fb118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22fb118*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.324] ReadFile (in: hFile=0x15c, lpBuffer=0x22fb118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22fb118*, lpNumberOfBytesRead=0x2edb68*=0xb20, lpOverlapped=0x0) returned 1 [0085.324] ReadFile (in: hFile=0x15c, lpBuffer=0x22fb020, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22fb020*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0085.324] ReadFile (in: hFile=0x15c, lpBuffer=0x22fb118, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22fb118*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0085.324] CloseHandle (hObject=0x15c) returned 1 [0085.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js", lpFilePart=0x0) returned 0x99 [0085.324] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 1 [0085.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFilePart=0x0) returned 0x9b [0085.325] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", dwFileAttributes=0x80) returned 1 [0085.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.Horsuke", lpFilePart=0x0) returned 0xa3 [0085.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0085.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0085.327] GetFileType (hFile=0x228) returned 0x1 [0085.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0085.327] GetFileType (hFile=0x228) returned 0x1 [0085.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFilePart=0x0) returned 0x9b [0085.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0085.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0085.786] GetFileType (hFile=0x15c) returned 0x1 [0085.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0085.786] GetFileType (hFile=0x15c) returned 0x1 [0085.786] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.791] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.796] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.796] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.796] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.797] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.797] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.797] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.797] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.797] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.798] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.798] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.798] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.798] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.798] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.799] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.799] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.800] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.801] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.801] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.801] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.801] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.801] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.801] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.802] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.802] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.802] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.802] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.802] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.803] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.803] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.803] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.803] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.803] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.804] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.804] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.804] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.804] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.804] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.805] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.805] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.805] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.805] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.805] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.805] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.806] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.806] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.806] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.806] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.807] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.808] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.808] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.808] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.808] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.808] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.809] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.809] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.809] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.809] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.809] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.810] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.810] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.811] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.811] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.811] ReadFile (in: hFile=0x15c, lpBuffer=0x23e6a38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23e6a38*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0085.813] ReadFile (in: hFile=0x15c, lpBuffer=0x222ff40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222ff40*, lpNumberOfBytesRead=0x2edb68*=0x39, lpOverlapped=0x0) returned 1 [0085.813] ReadFile (in: hFile=0x15c, lpBuffer=0x222ff40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x222ff40*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0085.813] CloseHandle (hObject=0x15c) returned 1 [0085.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css", lpFilePart=0x0) returned 0x9b [0085.813] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 1 [0085.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFilePart=0x0) returned 0xa2 [0085.816] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", dwFileAttributes=0x80) returned 1 [0085.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.Horsuke", lpFilePart=0x0) returned 0xaa [0085.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0085.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0085.817] GetFileType (hFile=0x228) returned 0x1 [0085.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0085.817] GetFileType (hFile=0x228) returned 0x1 [0086.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFilePart=0x0) returned 0xa2 [0086.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0086.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0086.362] GetFileType (hFile=0x15c) returned 0x1 [0086.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0086.362] GetFileType (hFile=0x15c) returned 0x1 [0086.362] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.381] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.384] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.384] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.384] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.385] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.385] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.385] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0xc33, lpOverlapped=0x0) returned 1 [0086.385] ReadFile (in: hFile=0x15c, lpBuffer=0x23183e3, nNumberOfBytesToRead=0x3cd, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23183e3*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0086.386] ReadFile (in: hFile=0x15c, lpBuffer=0x23187c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x23187c8*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0086.386] CloseHandle (hObject=0x15c) returned 1 [0086.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js", lpFilePart=0x0) returned 0xa2 [0086.386] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 1 [0086.387] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a [0086.387] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", dwFileAttributes=0x80) returned 1 [0086.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.Horsuke", lpFilePart=0x0) returned 0xa2 [0086.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0086.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0086.389] GetFileType (hFile=0x228) returned 0x1 [0086.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0086.389] GetFileType (hFile=0x228) returned 0x1 [0086.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a [0086.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0086.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0086.851] GetFileType (hFile=0x15c) returned 0x1 [0086.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0086.851] GetFileType (hFile=0x15c) returned 0x1 [0086.851] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.857] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.858] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.858] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.858] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.858] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.859] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.859] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.859] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.859] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.859] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.860] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.860] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.860] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.860] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.860] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.861] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.861] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.861] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.861] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.861] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.862] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.862] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.862] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.862] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.862] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.863] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.863] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.863] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.863] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.863] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.863] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.864] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.864] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.864] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.864] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.864] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.865] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.865] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.865] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.865] ReadFile (in: hFile=0x15c, lpBuffer=0x24093b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x24093b0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.868] ReadFile (in: hFile=0x15c, lpBuffer=0x2235720, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2235720*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0086.868] ReadFile (in: hFile=0x15c, lpBuffer=0x2235720, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2235720*, lpNumberOfBytesRead=0x2edb68*=0xdeb, lpOverlapped=0x0) returned 1 [0086.868] ReadFile (in: hFile=0x15c, lpBuffer=0x22354f3, nNumberOfBytesToRead=0x215, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x22354f3*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0086.868] ReadFile (in: hFile=0x15c, lpBuffer=0x2235720, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2235720*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0086.868] CloseHandle (hObject=0x15c) returned 1 [0086.868] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js", lpFilePart=0x0) returned 0x9a [0086.869] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 1 [0086.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c [0086.870] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", dwFileAttributes=0x80) returned 1 [0086.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.Horsuke", lpFilePart=0x0) returned 0xa4 [0086.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0086.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0086.872] GetFileType (hFile=0x228) returned 0x1 [0086.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0086.872] GetFileType (hFile=0x228) returned 0x1 [0087.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c [0087.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0087.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0087.329] GetFileType (hFile=0x15c) returned 0x1 [0087.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0087.329] GetFileType (hFile=0x15c) returned 0x1 [0087.329] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.334] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.336] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.336] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.336] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.337] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.337] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.337] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.337] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.337] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.338] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.338] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.338] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.338] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.338] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.339] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.340] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.341] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.341] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.341] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.341] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.342] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.343] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.343] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.343] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.343] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.344] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.344] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.344] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.344] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.344] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.345] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.345] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.345] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.345] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.345] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.346] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.346] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.346] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.346] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.346] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.347] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.348] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.348] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.348] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.348] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.349] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.349] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.349] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.349] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.350] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.350] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.350] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.350] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.350] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.351] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.351] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.351] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.351] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.351] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.352] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.352] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.353] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.353] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.353] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.353] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.354] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.354] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.354] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.354] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.354] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.355] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.355] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.355] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.356] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.356] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.357] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.357] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.357] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.357] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.357] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.358] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.358] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.358] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.358] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.358] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.359] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.359] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.359] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.359] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.360] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.360] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.360] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.360] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.360] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.361] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.361] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.361] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.361] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.361] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.362] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.362] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.362] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.362] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.362] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.363] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.363] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.363] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.363] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.364] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.364] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.364] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.364] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.365] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.365] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.365] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x1000, lpOverlapped=0x0) returned 1 [0087.365] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x4cf, lpOverlapped=0x0) returned 1 [0087.365] ReadFile (in: hFile=0x15c, lpBuffer=0x231f297, nNumberOfBytesToRead=0x331, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f297*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0087.365] ReadFile (in: hFile=0x15c, lpBuffer=0x231f5e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x231f5e0*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0087.366] CloseHandle (hObject=0x15c) returned 1 [0087.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js", lpFilePart=0x0) returned 0x9c [0087.366] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 1 [0087.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a [0087.370] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", dwFileAttributes=0x80) returned 1 [0087.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.Horsuke", lpFilePart=0x0) returned 0xa2 [0087.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0087.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0087.371] GetFileType (hFile=0x228) returned 0x1 [0087.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0087.371] GetFileType (hFile=0x228) returned 0x1 [0087.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x2ed550, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a [0087.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda30) returned 1 [0087.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0087.838] GetFileType (hFile=0x15c) returned 0x1 [0087.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0087.838] GetFileType (hFile=0x15c) returned 0x1 [0087.838] ReadFile (in: hFile=0x15c, lpBuffer=0x2284570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2284570*, lpNumberOfBytesRead=0x2edb68*=0x941, lpOverlapped=0x0) returned 1 [0087.856] ReadFile (in: hFile=0x15c, lpBuffer=0x2284299, nNumberOfBytesToRead=0x2bf, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2284299*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0087.856] ReadFile (in: hFile=0x15c, lpBuffer=0x2284570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edb68, lpOverlapped=0x0 | out: lpBuffer=0x2284570*, lpNumberOfBytesRead=0x2edb68*=0x0, lpOverlapped=0x0) returned 1 [0087.856] CloseHandle (hObject=0x15c) returned 1 [0087.857] WriteFile (in: hFile=0x228, lpBuffer=0x22829c0*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2eda38, lpOverlapped=0x0 | out: lpBuffer=0x22829c0*, lpNumberOfBytesWritten=0x2eda38*=0x970, lpOverlapped=0x0) returned 1 [0087.857] CloseHandle (hObject=0x228) returned 1 [0087.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", nBufferLength=0x105, lpBuffer=0x2ed660, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js", lpFilePart=0x0) returned 0x9a [0087.858] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 1 [0087.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0087.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", lpFilePart=0x0) returned 0x91 [0087.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", lpFilePart=0x0) returned 0x92 [0087.859] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0087.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.868] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.869] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0087.869] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0087.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0087.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0087.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0087.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup", lpFilePart=0x0) returned 0x91 [0087.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\", lpFilePart=0x0) returned 0x92 [0087.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0087.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.872] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.872] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.872] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0087.872] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0087.872] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0087.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0087.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0087.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e [0087.873] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", dwFileAttributes=0x80) returned 1 [0087.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.Horsuke", lpFilePart=0x0) returned 0xa6 [0087.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0087.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0087.875] GetFileType (hFile=0x228) returned 0x1 [0087.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0087.875] GetFileType (hFile=0x228) returned 0x1 [0088.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e [0088.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0088.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0088.476] GetFileType (hFile=0x15c) returned 0x1 [0088.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0088.476] GetFileType (hFile=0x15c) returned 0x1 [0088.476] ReadFile (in: hFile=0x15c, lpBuffer=0x2375570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2375570*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0088.490] ReadFile (in: hFile=0x15c, lpBuffer=0x2375570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2375570*, lpNumberOfBytesRead=0x2edae8*=0xa1d, lpOverlapped=0x0) returned 1 [0088.492] ReadFile (in: hFile=0x15c, lpBuffer=0x2375375, nNumberOfBytesToRead=0x1e3, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2375375*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0088.492] ReadFile (in: hFile=0x15c, lpBuffer=0x2375570, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2375570*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0088.492] CloseHandle (hObject=0x15c) returned 1 [0088.493] WriteFile (in: hFile=0x228, lpBuffer=0x23739c0*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x23739c0*, lpNumberOfBytesWritten=0x2ed9b8*=0xa40, lpOverlapped=0x0) returned 1 [0088.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css", lpFilePart=0x0) returned 0x9e [0088.493] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1 [0088.494] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d [0088.494] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", dwFileAttributes=0x80) returned 1 [0088.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.Horsuke", lpFilePart=0x0) returned 0xa5 [0088.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0088.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0088.495] GetFileType (hFile=0x228) returned 0x1 [0088.495] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0088.495] GetFileType (hFile=0x228) returned 0x1 [0088.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d [0088.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0088.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0088.969] GetFileType (hFile=0x15c) returned 0x1 [0088.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0088.969] GetFileType (hFile=0x15c) returned 0x1 [0088.969] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0088.975] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.026] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.026] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.026] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.027] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.027] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.027] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.027] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.028] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.028] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.028] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.029] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.029] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.029] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.030] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.030] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.030] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.031] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.031] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.031] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.032] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.032] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.032] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.032] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.033] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.033] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.033] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.033] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.034] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.034] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.034] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.034] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.035] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0089.035] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x1da, lpOverlapped=0x0) returned 1 [0089.035] ReadFile (in: hFile=0x15c, lpBuffer=0x225fd80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x225fd80*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0089.035] CloseHandle (hObject=0x15c) returned 1 [0089.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js", lpFilePart=0x0) returned 0x9d [0089.036] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1 [0089.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6 [0089.037] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", dwFileAttributes=0x80) returned 1 [0089.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.Horsuke", lpFilePart=0x0) returned 0xae [0089.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0089.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0089.039] GetFileType (hFile=0x228) returned 0x1 [0089.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0089.039] GetFileType (hFile=0x228) returned 0x1 [0089.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6 [0089.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0089.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0089.482] GetFileType (hFile=0x15c) returned 0x1 [0089.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0089.482] GetFileType (hFile=0x15c) returned 0x1 [0089.482] ReadFile (in: hFile=0x15c, lpBuffer=0x236b938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x236b938*, lpNumberOfBytesRead=0x2edae8*=0xf2, lpOverlapped=0x0) returned 1 [0089.483] ReadFile (in: hFile=0x15c, lpBuffer=0x236b938, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x236b938*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0089.483] CloseHandle (hObject=0x15c) returned 1 [0089.483] WriteFile (in: hFile=0x228, lpBuffer=0x2369d68*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x2369d68*, lpNumberOfBytesWritten=0x2ed9b8*=0x120, lpOverlapped=0x0) returned 1 [0089.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js", lpFilePart=0x0) returned 0xa6 [0089.484] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1 [0089.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa [0089.485] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", dwFileAttributes=0x80) returned 1 [0089.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.Horsuke", lpFilePart=0x0) returned 0xb2 [0089.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0089.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0089.486] GetFileType (hFile=0x228) returned 0x1 [0089.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0089.486] GetFileType (hFile=0x228) returned 0x1 [0089.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa [0089.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0089.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0089.949] GetFileType (hFile=0x15c) returned 0x1 [0089.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0089.949] GetFileType (hFile=0x15c) returned 0x1 [0089.949] ReadFile (in: hFile=0x15c, lpBuffer=0x2254100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2254100*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0090.106] ReadFile (in: hFile=0x15c, lpBuffer=0x2254100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2254100*, lpNumberOfBytesRead=0x2edae8*=0xbef, lpOverlapped=0x0) returned 1 [0090.106] ReadFile (in: hFile=0x15c, lpBuffer=0x22540d7, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22540d7*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0090.106] ReadFile (in: hFile=0x15c, lpBuffer=0x2254100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2254100*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0090.106] CloseHandle (hObject=0x15c) returned 1 [0090.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png", lpFilePart=0x0) returned 0xaa [0090.107] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0090.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e [0090.107] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", dwFileAttributes=0x80) returned 1 [0090.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.Horsuke", lpFilePart=0x0) returned 0xa6 [0090.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0090.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0090.109] GetFileType (hFile=0x228) returned 0x1 [0090.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0090.109] GetFileType (hFile=0x228) returned 0x1 [0090.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e [0090.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0090.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0090.586] GetFileType (hFile=0x15c) returned 0x1 [0090.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0090.586] GetFileType (hFile=0x15c) returned 0x1 [0090.586] ReadFile (in: hFile=0x15c, lpBuffer=0x233e148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x233e148*, lpNumberOfBytesRead=0x2edae8*=0x3b, lpOverlapped=0x0) returned 1 [0090.587] ReadFile (in: hFile=0x15c, lpBuffer=0x233e148, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x233e148*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0090.587] CloseHandle (hObject=0x15c) returned 1 [0090.587] WriteFile (in: hFile=0x228, lpBuffer=0x233c598*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x233c598*, lpNumberOfBytesWritten=0x2ed9b8*=0x60, lpOverlapped=0x0) returned 1 [0090.588] CloseHandle (hObject=0x228) returned 1 [0090.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html", lpFilePart=0x0) returned 0x9e [0090.588] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1 [0090.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c [0090.589] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", dwFileAttributes=0x80) returned 1 [0090.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.Horsuke", lpFilePart=0x0) returned 0xa4 [0090.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0090.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0090.591] GetFileType (hFile=0x228) returned 0x1 [0090.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0090.591] GetFileType (hFile=0x228) returned 0x1 [0091.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c [0091.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0091.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0091.038] GetFileType (hFile=0x15c) returned 0x1 [0091.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0091.038] GetFileType (hFile=0x15c) returned 0x1 [0091.038] ReadFile (in: hFile=0x15c, lpBuffer=0x2424e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2424e90*, lpNumberOfBytesRead=0x2edae8*=0x828, lpOverlapped=0x0) returned 1 [0091.049] ReadFile (in: hFile=0x15c, lpBuffer=0x2424aa0, nNumberOfBytesToRead=0x3d8, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2424aa0*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0091.049] ReadFile (in: hFile=0x15c, lpBuffer=0x2424e90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x2424e90*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0091.050] CloseHandle (hObject=0x15c) returned 1 [0091.050] WriteFile (in: hFile=0x228, lpBuffer=0x24232e8*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x24232e8*, lpNumberOfBytesWritten=0x2ed9b8*=0x850, lpOverlapped=0x0) returned 1 [0091.051] CloseHandle (hObject=0x228) returned 1 [0091.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html", lpFilePart=0x0) returned 0x9c [0091.051] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1 [0091.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d [0091.052] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", dwFileAttributes=0x80) returned 1 [0091.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.Horsuke", lpFilePart=0x0) returned 0xa5 [0091.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0091.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0091.057] GetFileType (hFile=0x228) returned 0x1 [0091.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0091.057] GetFileType (hFile=0x228) returned 0x1 [0091.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d [0091.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0091.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0091.509] GetFileType (hFile=0x15c) returned 0x1 [0091.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0091.510] GetFileType (hFile=0x15c) returned 0x1 [0091.510] ReadFile (in: hFile=0x15c, lpBuffer=0x230c3f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x230c3f0*, lpNumberOfBytesRead=0x2edae8*=0x3b, lpOverlapped=0x0) returned 1 [0091.511] ReadFile (in: hFile=0x15c, lpBuffer=0x230c3f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x230c3f0*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0091.511] CloseHandle (hObject=0x15c) returned 1 [0091.511] WriteFile (in: hFile=0x228, lpBuffer=0x230a848*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x230a848*, lpNumberOfBytesWritten=0x2ed9b8*=0x60, lpOverlapped=0x0) returned 1 [0091.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html", lpFilePart=0x0) returned 0x9d [0091.512] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1 [0091.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c [0091.512] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", dwFileAttributes=0x80) returned 1 [0091.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.Horsuke", lpFilePart=0x0) returned 0xa4 [0091.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0091.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0091.514] GetFileType (hFile=0x228) returned 0x1 [0091.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0091.514] GetFileType (hFile=0x228) returned 0x1 [0091.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c [0091.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0091.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0091.962] GetFileType (hFile=0x15c) returned 0x1 [0091.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0091.962] GetFileType (hFile=0x15c) returned 0x1 [0091.963] ReadFile (in: hFile=0x15c, lpBuffer=0x23f3130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23f3130*, lpNumberOfBytesRead=0x2edae8*=0x3b, lpOverlapped=0x0) returned 1 [0091.963] ReadFile (in: hFile=0x15c, lpBuffer=0x23f3130, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23f3130*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0091.964] CloseHandle (hObject=0x15c) returned 1 [0091.964] WriteFile (in: hFile=0x228, lpBuffer=0x23f1588*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x23f1588*, lpNumberOfBytesWritten=0x2ed9b8*=0x60, lpOverlapped=0x0) returned 1 [0091.965] CloseHandle (hObject=0x228) returned 1 [0091.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html", lpFilePart=0x0) returned 0x9c [0091.965] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1 [0091.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.TXT", lpFilePart=0x0) returned 0x9a [0091.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0091.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0091.968] GetFileType (hFile=0x228) returned 0x1 [0091.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0091.968] GetFileType (hFile=0x228) returned 0x1 [0091.968] WriteFile (in: hFile=0x228, lpBuffer=0x23fd798*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x23fd798*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0091.969] CloseHandle (hObject=0x228) returned 1 [0091.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.png", lpFilePart=0x0) returned 0x9a [0091.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0091.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0091.970] GetFileType (hFile=0x228) returned 0x1 [0091.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0091.970] GetFileType (hFile=0x228) returned 0x1 [0091.970] WriteFile (in: hFile=0x228, lpBuffer=0x23fe900*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x23fe900*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0091.971] CloseHandle (hObject=0x228) returned 1 [0091.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.vbs", lpFilePart=0x0) returned 0x9a [0091.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0091.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0091.972] GetFileType (hFile=0x228) returned 0x1 [0091.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0091.972] GetFileType (hFile=0x228) returned 0x1 [0091.972] WriteFile (in: hFile=0x228, lpBuffer=0x24026b0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x24026b0*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0091.973] CloseHandle (hObject=0x228) returned 1 [0091.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc6 [0091.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0091.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0091.973] GetFileType (hFile=0x228) returned 0x1 [0091.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0091.973] GetFileType (hFile=0x228) returned 0x1 [0091.973] WriteFile (in: hFile=0x228, lpBuffer=0x2405220*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x2405220*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0091.974] CloseHandle (hObject=0x228) returned 1 [0091.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0091.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", lpFilePart=0x0) returned 0x9a [0091.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", lpFilePart=0x0) returned 0x9b [0091.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0091.974] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0091.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0091.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0091.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0091.975] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0091.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0091.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0091.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0091.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details", lpFilePart=0x0) returned 0x9a [0091.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\", lpFilePart=0x0) returned 0x9b [0091.975] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0091.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0091.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0091.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0091.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0091.976] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0091.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0091.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0091.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4 [0091.976] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", dwFileAttributes=0x80) returned 1 [0091.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.Horsuke", lpFilePart=0x0) returned 0xac [0091.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0091.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0091.978] GetFileType (hFile=0x228) returned 0x1 [0091.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0091.978] GetFileType (hFile=0x228) returned 0x1 [0092.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4 [0092.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0092.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0092.464] GetFileType (hFile=0x15c) returned 0x1 [0092.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0092.464] GetFileType (hFile=0x15c) returned 0x1 [0092.464] ReadFile (in: hFile=0x15c, lpBuffer=0x22f0738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22f0738*, lpNumberOfBytesRead=0x2edae8*=0x1000, lpOverlapped=0x0) returned 1 [0092.481] ReadFile (in: hFile=0x15c, lpBuffer=0x22f0738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22f0738*, lpNumberOfBytesRead=0x2edae8*=0x74c, lpOverlapped=0x0) returned 1 [0092.482] ReadFile (in: hFile=0x15c, lpBuffer=0x22f066c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22f066c*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0092.482] ReadFile (in: hFile=0x15c, lpBuffer=0x22f0738, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x22f0738*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0092.482] CloseHandle (hObject=0x15c) returned 1 [0092.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html", lpFilePart=0x0) returned 0xa4 [0092.483] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1 [0092.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2 [0092.484] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", dwFileAttributes=0x80) returned 1 [0092.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.Horsuke", lpFilePart=0x0) returned 0xaa [0092.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0092.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0092.488] GetFileType (hFile=0x228) returned 0x1 [0092.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0092.488] GetFileType (hFile=0x228) returned 0x1 [0092.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x2ed4d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2 [0092.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9b0) returned 1 [0092.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0092.947] GetFileType (hFile=0x15c) returned 0x1 [0092.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed920) returned 1 [0092.948] GetFileType (hFile=0x15c) returned 0x1 [0092.948] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23d8c30*, lpNumberOfBytesRead=0x2edae8*=0x945, lpOverlapped=0x0) returned 1 [0092.961] ReadFile (in: hFile=0x15c, lpBuffer=0x23d895d, nNumberOfBytesToRead=0x2bb, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23d895d*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0092.961] ReadFile (in: hFile=0x15c, lpBuffer=0x23d8c30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edae8, lpOverlapped=0x0 | out: lpBuffer=0x23d8c30*, lpNumberOfBytesRead=0x2edae8*=0x0, lpOverlapped=0x0) returned 1 [0092.962] CloseHandle (hObject=0x15c) returned 1 [0092.962] WriteFile (in: hFile=0x228, lpBuffer=0x23d7088*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2ed9b8, lpOverlapped=0x0 | out: lpBuffer=0x23d7088*, lpNumberOfBytesWritten=0x2ed9b8*=0x970, lpOverlapped=0x0) returned 1 [0092.962] CloseHandle (hObject=0x228) returned 1 [0092.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", nBufferLength=0x105, lpBuffer=0x2ed5e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js", lpFilePart=0x0) returned 0xa2 [0092.963] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1 [0092.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.TXT", lpFilePart=0x0) returned 0xa3 [0092.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0092.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0092.966] GetFileType (hFile=0x228) returned 0x1 [0092.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0092.966] GetFileType (hFile=0x228) returned 0x1 [0092.966] WriteFile (in: hFile=0x228, lpBuffer=0x23e3c08*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x23e3c08*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0092.967] CloseHandle (hObject=0x228) returned 1 [0092.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.png", lpFilePart=0x0) returned 0xa3 [0092.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0092.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0092.968] GetFileType (hFile=0x228) returned 0x1 [0092.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0092.968] GetFileType (hFile=0x228) returned 0x1 [0092.968] WriteFile (in: hFile=0x228, lpBuffer=0x23e4d80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x23e4d80*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0092.969] CloseHandle (hObject=0x228) returned 1 [0092.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.vbs", lpFilePart=0x0) returned 0xa3 [0092.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0092.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0092.970] GetFileType (hFile=0x228) returned 0x1 [0092.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0092.970] GetFileType (hFile=0x228) returned 0x1 [0092.970] WriteFile (in: hFile=0x228, lpBuffer=0x23e8b60*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x23e8b60*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0092.971] CloseHandle (hObject=0x228) returned 1 [0092.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xcf [0092.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0092.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0092.971] GetFileType (hFile=0x228) returned 0x1 [0092.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0092.971] GetFileType (hFile=0x228) returned 0x1 [0092.971] WriteFile (in: hFile=0x228, lpBuffer=0x23eb6f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x23eb6f0*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0092.972] CloseHandle (hObject=0x228) returned 1 [0092.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0092.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", lpFilePart=0x0) returned 0x8f [0092.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", lpFilePart=0x0) returned 0x90 [0092.972] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0092.974] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.975] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.976] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.977] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0092.981] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0092.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0092.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0092.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0092.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales", lpFilePart=0x0) returned 0x8f [0092.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\", lpFilePart=0x0) returned 0x90 [0092.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0092.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.983] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.986] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0092.987] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0092.988] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0092.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0092.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0092.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0092.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", lpFilePart=0x0) returned 0x92 [0092.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", lpFilePart=0x0) returned 0x93 [0092.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0092.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0092.989] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0092.990] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0092.990] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0092.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0092.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0092.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0092.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am", lpFilePart=0x0) returned 0x92 [0092.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\", lpFilePart=0x0) returned 0x93 [0092.990] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0092.990] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0092.990] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0092.991] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0092.991] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0092.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0092.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0092.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0092.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0092.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0092.992] GetFileType (hFile=0x228) returned 0x1 [0092.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0092.992] GetFileType (hFile=0x228) returned 0x1 [0092.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.png", lpFilePart=0x0) returned 0x9b [0092.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0092.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0092.993] GetFileType (hFile=0x228) returned 0x1 [0092.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0092.993] GetFileType (hFile=0x228) returned 0x1 [0092.993] WriteFile (in: hFile=0x228, lpBuffer=0x2410cc8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2410cc8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0092.994] CloseHandle (hObject=0x228) returned 1 [0092.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0092.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0092.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0092.994] GetFileType (hFile=0x228) returned 0x1 [0092.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0092.994] GetFileType (hFile=0x228) returned 0x1 [0092.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0092.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0092.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0092.999] GetFileType (hFile=0x228) returned 0x1 [0092.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0092.999] GetFileType (hFile=0x228) returned 0x1 [0093.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", lpFilePart=0x0) returned 0x92 [0093.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x93 [0093.000] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.009] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.009] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar", lpFilePart=0x0) returned 0x92 [0093.009] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\", lpFilePart=0x0) returned 0x93 [0093.009] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.009] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.010] GetFileType (hFile=0x228) returned 0x1 [0093.010] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.010] GetFileType (hFile=0x228) returned 0x1 [0093.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.012] GetFileType (hFile=0x228) returned 0x1 [0093.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.012] GetFileType (hFile=0x228) returned 0x1 [0093.012] WriteFile (in: hFile=0x228, lpBuffer=0x24263e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x24263e0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.013] CloseHandle (hObject=0x228) returned 1 [0093.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.013] GetFileType (hFile=0x228) returned 0x1 [0093.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.013] GetFileType (hFile=0x228) returned 0x1 [0093.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.016] GetFileType (hFile=0x228) returned 0x1 [0093.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.016] GetFileType (hFile=0x228) returned 0x1 [0093.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", lpFilePart=0x0) returned 0x92 [0093.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x93 [0093.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.017] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.017] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.017] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.017] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg", lpFilePart=0x0) returned 0x92 [0093.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\", lpFilePart=0x0) returned 0x93 [0093.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.018] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.018] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.018] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.018] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.018] GetFileType (hFile=0x228) returned 0x1 [0093.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.019] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.019] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.022] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", lpFilePart=0x0) returned 0x92 [0093.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x93 [0093.036] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.037] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.037] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn", lpFilePart=0x0) returned 0x92 [0093.038] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\", lpFilePart=0x0) returned 0x93 [0093.038] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.038] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.038] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.041] WriteFile (in: hFile=0x228, lpBuffer=0x2253e50*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2253e50*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.043] GetFileType (hFile=0x228) returned 0x1 [0093.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.043] GetFileType (hFile=0x228) returned 0x1 [0093.043] WriteFile (in: hFile=0x228, lpBuffer=0x2254fb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2254fb8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.043] CloseHandle (hObject=0x228) returned 1 [0093.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.044] GetFileType (hFile=0x228) returned 0x1 [0093.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.044] GetFileType (hFile=0x228) returned 0x1 [0093.044] WriteFile (in: hFile=0x228, lpBuffer=0x2258d68*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2258d68*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.045] CloseHandle (hObject=0x228) returned 1 [0093.045] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.047] GetFileType (hFile=0x228) returned 0x1 [0093.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.047] GetFileType (hFile=0x228) returned 0x1 [0093.047] WriteFile (in: hFile=0x228, lpBuffer=0x225b8d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x225b8d8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.048] CloseHandle (hObject=0x228) returned 1 [0093.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", lpFilePart=0x0) returned 0x92 [0093.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x93 [0093.048] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.048] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.049] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.049] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca", lpFilePart=0x0) returned 0x92 [0093.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\", lpFilePart=0x0) returned 0x93 [0093.049] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.049] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.049] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.052] GetFileType (hFile=0x228) returned 0x1 [0093.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.052] GetFileType (hFile=0x228) returned 0x1 [0093.052] WriteFile (in: hFile=0x228, lpBuffer=0x2269568*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2269568*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.053] CloseHandle (hObject=0x228) returned 1 [0093.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.054] GetFileType (hFile=0x228) returned 0x1 [0093.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.054] GetFileType (hFile=0x228) returned 0x1 [0093.054] WriteFile (in: hFile=0x228, lpBuffer=0x226a6d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x226a6d0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.055] CloseHandle (hObject=0x228) returned 1 [0093.055] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.055] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.055] GetFileType (hFile=0x228) returned 0x1 [0093.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.056] GetFileType (hFile=0x228) returned 0x1 [0093.056] WriteFile (in: hFile=0x228, lpBuffer=0x226e480*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x226e480*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.056] CloseHandle (hObject=0x228) returned 1 [0093.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.058] GetFileType (hFile=0x228) returned 0x1 [0093.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.058] GetFileType (hFile=0x228) returned 0x1 [0093.058] WriteFile (in: hFile=0x228, lpBuffer=0x2270ff0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2270ff0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.059] CloseHandle (hObject=0x228) returned 1 [0093.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", lpFilePart=0x0) returned 0x92 [0093.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x93 [0093.059] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.060] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.060] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.060] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.060] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs", lpFilePart=0x0) returned 0x92 [0093.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\", lpFilePart=0x0) returned 0x93 [0093.061] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.061] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.061] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.061] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.061] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.062] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.062] GetFileType (hFile=0x228) returned 0x1 [0093.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.062] GetFileType (hFile=0x228) returned 0x1 [0093.063] WriteFile (in: hFile=0x228, lpBuffer=0x227ec80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x227ec80*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.064] CloseHandle (hObject=0x228) returned 1 [0093.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.065] GetFileType (hFile=0x228) returned 0x1 [0093.065] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.065] GetFileType (hFile=0x228) returned 0x1 [0093.065] WriteFile (in: hFile=0x228, lpBuffer=0x227fde8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x227fde8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.066] CloseHandle (hObject=0x228) returned 1 [0093.066] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.066] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.066] GetFileType (hFile=0x228) returned 0x1 [0093.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.067] GetFileType (hFile=0x228) returned 0x1 [0093.067] WriteFile (in: hFile=0x228, lpBuffer=0x2283b98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2283b98*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.067] CloseHandle (hObject=0x228) returned 1 [0093.068] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.068] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.070] GetFileType (hFile=0x228) returned 0x1 [0093.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.071] GetFileType (hFile=0x228) returned 0x1 [0093.071] WriteFile (in: hFile=0x228, lpBuffer=0x2286708*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2286708*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.072] CloseHandle (hObject=0x228) returned 1 [0093.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", lpFilePart=0x0) returned 0x92 [0093.072] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", lpFilePart=0x0) returned 0x93 [0093.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.073] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da", lpFilePart=0x0) returned 0x92 [0093.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\", lpFilePart=0x0) returned 0x93 [0093.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.074] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.075] GetFileType (hFile=0x228) returned 0x1 [0093.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.075] GetFileType (hFile=0x228) returned 0x1 [0093.076] WriteFile (in: hFile=0x228, lpBuffer=0x2294398*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2294398*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.077] CloseHandle (hObject=0x228) returned 1 [0093.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.077] GetFileType (hFile=0x228) returned 0x1 [0093.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.077] GetFileType (hFile=0x228) returned 0x1 [0093.078] WriteFile (in: hFile=0x228, lpBuffer=0x2295500*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2295500*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.078] CloseHandle (hObject=0x228) returned 1 [0093.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.079] GetFileType (hFile=0x228) returned 0x1 [0093.079] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.079] GetFileType (hFile=0x228) returned 0x1 [0093.079] WriteFile (in: hFile=0x228, lpBuffer=0x22992b0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22992b0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.080] CloseHandle (hObject=0x228) returned 1 [0093.080] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.081] GetFileType (hFile=0x228) returned 0x1 [0093.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.081] GetFileType (hFile=0x228) returned 0x1 [0093.082] WriteFile (in: hFile=0x228, lpBuffer=0x229be20*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x229be20*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.082] CloseHandle (hObject=0x228) returned 1 [0093.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", lpFilePart=0x0) returned 0x92 [0093.082] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", lpFilePart=0x0) returned 0x93 [0093.083] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.083] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.084] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de", lpFilePart=0x0) returned 0x92 [0093.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\", lpFilePart=0x0) returned 0x93 [0093.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.084] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.084] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.085] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.085] GetFileType (hFile=0x228) returned 0x1 [0093.085] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.085] GetFileType (hFile=0x228) returned 0x1 [0093.085] WriteFile (in: hFile=0x228, lpBuffer=0x22a9ab0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22a9ab0*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.086] CloseHandle (hObject=0x228) returned 1 [0093.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.087] GetFileType (hFile=0x228) returned 0x1 [0093.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.087] GetFileType (hFile=0x228) returned 0x1 [0093.087] WriteFile (in: hFile=0x228, lpBuffer=0x22aac18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22aac18*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.088] CloseHandle (hObject=0x228) returned 1 [0093.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.088] GetFileType (hFile=0x228) returned 0x1 [0093.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.088] GetFileType (hFile=0x228) returned 0x1 [0093.088] WriteFile (in: hFile=0x228, lpBuffer=0x22ae9c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22ae9c8*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.089] CloseHandle (hObject=0x228) returned 1 [0093.089] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.104] GetFileType (hFile=0x228) returned 0x1 [0093.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.104] GetFileType (hFile=0x228) returned 0x1 [0093.104] WriteFile (in: hFile=0x228, lpBuffer=0x22b1538*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22b1538*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.105] CloseHandle (hObject=0x228) returned 1 [0093.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", lpFilePart=0x0) returned 0x92 [0093.105] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", lpFilePart=0x0) returned 0x93 [0093.105] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.105] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.106] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el", lpFilePart=0x0) returned 0x92 [0093.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\", lpFilePart=0x0) returned 0x93 [0093.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.106] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.107] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.107] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.107] GetFileType (hFile=0x228) returned 0x1 [0093.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.107] GetFileType (hFile=0x228) returned 0x1 [0093.108] WriteFile (in: hFile=0x228, lpBuffer=0x22bf1c8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22bf1c8*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.108] CloseHandle (hObject=0x228) returned 1 [0093.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.109] GetFileType (hFile=0x228) returned 0x1 [0093.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.109] GetFileType (hFile=0x228) returned 0x1 [0093.109] WriteFile (in: hFile=0x228, lpBuffer=0x22c0330*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22c0330*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.110] CloseHandle (hObject=0x228) returned 1 [0093.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.110] GetFileType (hFile=0x228) returned 0x1 [0093.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.110] GetFileType (hFile=0x228) returned 0x1 [0093.111] WriteFile (in: hFile=0x228, lpBuffer=0x22c40e0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x22c40e0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.111] CloseHandle (hObject=0x228) returned 1 [0093.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.113] GetFileType (hFile=0x228) returned 0x1 [0093.113] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.113] GetFileType (hFile=0x228) returned 0x1 [0093.113] WriteFile (in: hFile=0x228, lpBuffer=0x22c6c50*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22c6c50*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.114] CloseHandle (hObject=0x228) returned 1 [0093.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", lpFilePart=0x0) returned 0x92 [0093.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", lpFilePart=0x0) returned 0x93 [0093.114] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.115] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.115] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.115] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.115] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en", lpFilePart=0x0) returned 0x92 [0093.115] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\", lpFilePart=0x0) returned 0x93 [0093.115] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.116] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.116] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.116] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.117] GetFileType (hFile=0x228) returned 0x1 [0093.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.117] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", lpFilePart=0x0) returned 0x92 [0093.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", lpFilePart=0x0) returned 0x93 [0093.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.122] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.122] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.123] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es", lpFilePart=0x0) returned 0x92 [0093.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\", lpFilePart=0x0) returned 0x93 [0093.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.123] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.126] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", lpFilePart=0x0) returned 0x92 [0093.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", lpFilePart=0x0) returned 0x93 [0093.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.130] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.131] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et", lpFilePart=0x0) returned 0x92 [0093.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\", lpFilePart=0x0) returned 0x93 [0093.131] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.131] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.133] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.135] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.135] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", lpFilePart=0x0) returned 0x92 [0093.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x93 [0093.144] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.144] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.145] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa", lpFilePart=0x0) returned 0x92 [0093.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\", lpFilePart=0x0) returned 0x93 [0093.145] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.145] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.145] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.147] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", lpFilePart=0x0) returned 0x92 [0093.152] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x93 [0093.152] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.153] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.153] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi", lpFilePart=0x0) returned 0x92 [0093.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\", lpFilePart=0x0) returned 0x93 [0093.153] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.154] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", lpFilePart=0x0) returned 0x93 [0093.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x94 [0093.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.160] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.161] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil", lpFilePart=0x0) returned 0x93 [0093.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\", lpFilePart=0x0) returned 0x94 [0093.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.162] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.TXT", lpFilePart=0x0) returned 0x9c [0093.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.png", lpFilePart=0x0) returned 0x9c [0093.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.vbs", lpFilePart=0x0) returned 0x9c [0093.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc8 [0093.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", lpFilePart=0x0) returned 0x92 [0093.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x93 [0093.173] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.174] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.174] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.174] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.174] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr", lpFilePart=0x0) returned 0x92 [0093.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\", lpFilePart=0x0) returned 0x93 [0093.175] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.175] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.175] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", lpFilePart=0x0) returned 0x92 [0093.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x93 [0093.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.182] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.182] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu", lpFilePart=0x0) returned 0x92 [0093.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\", lpFilePart=0x0) returned 0x93 [0093.182] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.183] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.183] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.183] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.183] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", lpFilePart=0x0) returned 0x92 [0093.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x93 [0093.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.190] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.190] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.190] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.190] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi", lpFilePart=0x0) returned 0x92 [0093.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\", lpFilePart=0x0) returned 0x93 [0093.190] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.190] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.191] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.191] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.191] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.195] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", lpFilePart=0x0) returned 0x92 [0093.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x93 [0093.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.197] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr", lpFilePart=0x0) returned 0x92 [0093.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\", lpFilePart=0x0) returned 0x93 [0093.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.198] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", lpFilePart=0x0) returned 0x92 [0093.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x93 [0093.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu", lpFilePart=0x0) returned 0x92 [0093.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\", lpFilePart=0x0) returned 0x93 [0093.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", lpFilePart=0x0) returned 0x92 [0093.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", lpFilePart=0x0) returned 0x93 [0093.212] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.212] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.212] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id", lpFilePart=0x0) returned 0x92 [0093.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\", lpFilePart=0x0) returned 0x93 [0093.212] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.213] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.213] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", lpFilePart=0x0) returned 0x92 [0093.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", lpFilePart=0x0) returned 0x93 [0093.218] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.219] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it", lpFilePart=0x0) returned 0x92 [0093.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\", lpFilePart=0x0) returned 0x93 [0093.220] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.220] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.220] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.220] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.220] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", lpFilePart=0x0) returned 0x92 [0093.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x93 [0093.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.226] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.226] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.226] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.226] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw", lpFilePart=0x0) returned 0x92 [0093.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\", lpFilePart=0x0) returned 0x93 [0093.226] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.227] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.227] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.227] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.227] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", lpFilePart=0x0) returned 0x92 [0093.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x93 [0093.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.233] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja", lpFilePart=0x0) returned 0x92 [0093.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\", lpFilePart=0x0) returned 0x93 [0093.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.234] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", lpFilePart=0x0) returned 0x92 [0093.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x93 [0093.240] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.240] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn", lpFilePart=0x0) returned 0x92 [0093.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\", lpFilePart=0x0) returned 0x93 [0093.241] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.241] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", lpFilePart=0x0) returned 0x92 [0093.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x93 [0093.246] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.247] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko", lpFilePart=0x0) returned 0x92 [0093.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\", lpFilePart=0x0) returned 0x93 [0093.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.247] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", lpFilePart=0x0) returned 0x92 [0093.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x93 [0093.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.252] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt", lpFilePart=0x0) returned 0x92 [0093.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\", lpFilePart=0x0) returned 0x93 [0093.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.253] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.255] WriteFile (in: hFile=0x228, lpBuffer=0x24460f0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x24460f0*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.263] WriteFile (in: hFile=0x228, lpBuffer=0x22284d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x22284d0*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.264] CloseHandle (hObject=0x228) returned 1 [0093.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", lpFilePart=0x0) returned 0x92 [0093.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x93 [0093.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.266] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv", lpFilePart=0x0) returned 0x92 [0093.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\", lpFilePart=0x0) returned 0x93 [0093.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.266] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.266] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.266] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.266] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.269] GetFileType (hFile=0x228) returned 0x1 [0093.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.269] GetFileType (hFile=0x228) returned 0x1 [0093.270] WriteFile (in: hFile=0x228, lpBuffer=0x2236160*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2236160*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.270] CloseHandle (hObject=0x228) returned 1 [0093.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.271] GetFileType (hFile=0x228) returned 0x1 [0093.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.271] GetFileType (hFile=0x228) returned 0x1 [0093.271] WriteFile (in: hFile=0x228, lpBuffer=0x22372c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22372c8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.272] CloseHandle (hObject=0x228) returned 1 [0093.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.277] GetFileType (hFile=0x228) returned 0x1 [0093.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.278] GetFileType (hFile=0x228) returned 0x1 [0093.278] WriteFile (in: hFile=0x228, lpBuffer=0x223b078*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x223b078*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.278] CloseHandle (hObject=0x228) returned 1 [0093.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.281] GetFileType (hFile=0x228) returned 0x1 [0093.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.281] GetFileType (hFile=0x228) returned 0x1 [0093.281] WriteFile (in: hFile=0x228, lpBuffer=0x223dbe8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x223dbe8*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.281] CloseHandle (hObject=0x228) returned 1 [0093.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", lpFilePart=0x0) returned 0x92 [0093.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x93 [0093.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.282] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.282] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml", lpFilePart=0x0) returned 0x92 [0093.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\", lpFilePart=0x0) returned 0x93 [0093.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.283] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.285] GetFileType (hFile=0x228) returned 0x1 [0093.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.285] GetFileType (hFile=0x228) returned 0x1 [0093.286] WriteFile (in: hFile=0x228, lpBuffer=0x224b878*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x224b878*, lpNumberOfBytesWritten=0x2ed978*=0x39b, lpOverlapped=0x0) returned 1 [0093.286] CloseHandle (hObject=0x228) returned 1 [0093.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.287] GetFileType (hFile=0x228) returned 0x1 [0093.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.287] GetFileType (hFile=0x228) returned 0x1 [0093.287] WriteFile (in: hFile=0x228, lpBuffer=0x224c9e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x224c9e0*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.288] CloseHandle (hObject=0x228) returned 1 [0093.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.288] GetFileType (hFile=0x228) returned 0x1 [0093.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.288] GetFileType (hFile=0x228) returned 0x1 [0093.289] WriteFile (in: hFile=0x228, lpBuffer=0x2250790*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed918, lpOverlapped=0x0 | out: lpBuffer=0x2250790*, lpNumberOfBytesWritten=0x2ed918*=0x13c, lpOverlapped=0x0) returned 1 [0093.289] CloseHandle (hObject=0x228) returned 1 [0093.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc7 [0093.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.291] GetFileType (hFile=0x228) returned 0x1 [0093.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.291] GetFileType (hFile=0x228) returned 0x1 [0093.291] WriteFile (in: hFile=0x228, lpBuffer=0x2253300*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed978, lpOverlapped=0x0 | out: lpBuffer=0x2253300*, lpNumberOfBytesWritten=0x2ed978*=0xc6, lpOverlapped=0x0) returned 1 [0093.292] CloseHandle (hObject=0x228) returned 1 [0093.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", lpFilePart=0x0) returned 0x92 [0093.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x93 [0093.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.293] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.293] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.293] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.293] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", nBufferLength=0x105, lpBuffer=0x2ed580, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr", lpFilePart=0x0) returned 0x92 [0093.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", nBufferLength=0x105, lpBuffer=0x2ed520, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\", lpFilePart=0x0) returned 0x93 [0093.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.294] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.294] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.294] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.294] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.TXT", lpFilePart=0x0) returned 0x9b [0093.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.294] GetFileType (hFile=0x228) returned 0x1 [0093.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.295] GetFileType (hFile=0x228) returned 0x1 [0093.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed4b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.png", lpFilePart=0x0) returned 0x9b [0093.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.296] GetFileType (hFile=0x228) returned 0x1 [0093.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.296] GetFileType (hFile=0x228) returned 0x1 [0093.296] WriteFile (in: hFile=0x228, lpBuffer=0x22620f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22620f8*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.297] CloseHandle (hObject=0x228) returned 1 [0093.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed3f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.vbs", lpFilePart=0x0) returned 0x9b [0093.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.297] GetFileType (hFile=0x228) returned 0x1 [0093.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.298] GetFileType (hFile=0x228) returned 0x1 [0093.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.300] GetFileType (hFile=0x228) returned 0x1 [0093.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.300] GetFileType (hFile=0x228) returned 0x1 [0093.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.301] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.301] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.301] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.301] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.301] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.302] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.302] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.302] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.302] GetFileType (hFile=0x228) returned 0x1 [0093.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.303] GetFileType (hFile=0x228) returned 0x1 [0093.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.304] GetFileType (hFile=0x228) returned 0x1 [0093.304] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.304] GetFileType (hFile=0x228) returned 0x1 [0093.304] WriteFile (in: hFile=0x228, lpBuffer=0x2277810*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x2277810*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.305] CloseHandle (hObject=0x228) returned 1 [0093.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.305] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.305] GetFileType (hFile=0x228) returned 0x1 [0093.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.305] GetFileType (hFile=0x228) returned 0x1 [0093.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.307] GetFileType (hFile=0x228) returned 0x1 [0093.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.307] GetFileType (hFile=0x228) returned 0x1 [0093.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.309] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.309] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.309] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.309] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.309] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.310] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.310] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.310] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.310] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.310] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.311] GetFileType (hFile=0x228) returned 0x1 [0093.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.311] GetFileType (hFile=0x228) returned 0x1 [0093.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.312] GetFileType (hFile=0x228) returned 0x1 [0093.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.312] GetFileType (hFile=0x228) returned 0x1 [0093.312] WriteFile (in: hFile=0x228, lpBuffer=0x228cf28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x228cf28*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.313] CloseHandle (hObject=0x228) returned 1 [0093.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.313] GetFileType (hFile=0x228) returned 0x1 [0093.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.313] GetFileType (hFile=0x228) returned 0x1 [0093.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.316] GetFileType (hFile=0x228) returned 0x1 [0093.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.316] GetFileType (hFile=0x228) returned 0x1 [0093.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.317] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.317] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.317] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.317] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.318] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.319] GetFileType (hFile=0x228) returned 0x1 [0093.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.319] GetFileType (hFile=0x228) returned 0x1 [0093.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.320] GetFileType (hFile=0x228) returned 0x1 [0093.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.320] GetFileType (hFile=0x228) returned 0x1 [0093.320] WriteFile (in: hFile=0x228, lpBuffer=0x22a2640*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22a2640*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.321] CloseHandle (hObject=0x228) returned 1 [0093.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.322] GetFileType (hFile=0x228) returned 0x1 [0093.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.322] GetFileType (hFile=0x228) returned 0x1 [0093.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.324] GetFileType (hFile=0x228) returned 0x1 [0093.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.324] GetFileType (hFile=0x228) returned 0x1 [0093.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.326] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.327] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.327] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.328] GetFileType (hFile=0x228) returned 0x1 [0093.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.328] GetFileType (hFile=0x228) returned 0x1 [0093.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.329] GetFileType (hFile=0x228) returned 0x1 [0093.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.329] GetFileType (hFile=0x228) returned 0x1 [0093.329] WriteFile (in: hFile=0x228, lpBuffer=0x22b7d58*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edab8, lpOverlapped=0x0 | out: lpBuffer=0x22b7d58*, lpNumberOfBytesWritten=0x2edab8*=0x2337, lpOverlapped=0x0) returned 1 [0093.330] CloseHandle (hObject=0x228) returned 1 [0093.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.330] GetFileType (hFile=0x228) returned 0x1 [0093.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.330] GetFileType (hFile=0x228) returned 0x1 [0093.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.334] GetFileType (hFile=0x228) returned 0x1 [0093.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.334] GetFileType (hFile=0x228) returned 0x1 [0093.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.335] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.335] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.335] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.335] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.335] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.336] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.336] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.336] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.336] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.337] GetFileType (hFile=0x228) returned 0x1 [0093.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.344] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.344] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.345] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.345] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.351] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.352] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.359] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.360] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.367] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.367] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.373] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.374] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.375] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.375] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.375] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.375] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.375] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.382] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.383] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.392] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.392] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.392] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.392] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.392] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.406] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.406] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.406] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.407] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.407] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.408] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.408] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.409] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.416] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.417] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.418] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.418] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.418] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.418] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.421] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.427] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.427] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.427] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.427] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.427] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0093.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.428] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.428] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.428] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.428] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9e0) returned 1 [0093.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9a0) returned 1 [0093.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed840) returned 1 [0093.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed990) returned 1 [0093.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed900) returned 1 [0093.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed8d0) returned 1 [0093.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.437] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.438] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.439] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.439] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.439] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.439] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.447] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.447] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.448] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.454] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.455] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.455] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.456] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.456] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.456] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.465] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.465] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.465] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.465] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.465] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.465] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.465] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.465] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.473] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.474] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.474] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.474] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.494] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.495] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.495] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.495] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.495] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.505] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.505] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.505] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.505] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.505] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\*", lpFindFileData=0x2ed730 | out: lpFindFileData=0x2ed730) returned 0x4cf840 [0093.506] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.506] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 1 [0093.506] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed780 | out: lpFindFileData=0x2ed780) returned 0 [0093.506] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.517] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0093.518] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.518] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf840 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0093.518] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0093.518] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.543] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.545] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.546] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.546] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.546] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.546] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.546] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.546] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.547] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.547] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.547] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.547] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.547] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.554] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.554] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.554] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.554] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.560] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.561] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.561] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.561] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.561] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0093.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.562] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.563] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0093.563] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.563] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.564] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0093.564] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.593] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.594] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.594] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.594] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.595] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.595] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.603] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.603] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0093.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0093.614] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0093.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0093.616] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.627] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.628] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0093.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0093.628] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0093.628] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0093.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0093.629] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.629] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0093.629] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0093.630] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0093.630] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.646] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.646] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.646] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.647] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.647] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\EVWhitelist\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\evwhitelist\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.652] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.653] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.653] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.653] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\FileTypePolicies\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\filetypepolicies\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.663] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.663] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.663] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.663] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.663] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.663] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\OriginTrials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\origintrials\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.669] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\PepperFlash\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.674] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.674] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.674] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\pnacl\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.674] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.678] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.678] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SSLErrorAssistant\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.679] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.683] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\SwReporter\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.683] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.688] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.688] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\WidevineCdm\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.688] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Hack.png", lpFilePart=0x0) returned 0x42 [0093.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\Hack.vbs", lpFilePart=0x0) returned 0x42 [0093.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6e [0093.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f [0093.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x40 [0093.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.703] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports", lpFilePart=0x0) returned 0x3f [0093.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\", lpFilePart=0x0) returned 0x40 [0093.703] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.703] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0093.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.png", lpFilePart=0x0) returned 0x48 [0093.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0093.706] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\CrashReports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0093.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.TXT", lpFilePart=0x0) returned 0x3b [0093.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.png", lpFilePart=0x0) returned 0x3b [0093.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Hack.vbs", lpFilePart=0x0) returned 0x3b [0093.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x67 [0093.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History", lpFilePart=0x0) returned 0x33 [0093.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\", lpFilePart=0x0) returned 0x34 [0093.713] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0xffffffffffffffff [0093.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0093.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0093.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.717] GetFileType (hFile=0x228) returned 0x1 [0093.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0093.717] GetFileType (hFile=0x228) returned 0x1 [0093.717] WriteFile (in: hFile=0x228, lpBuffer=0x2264ba0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2264ba0*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0093.718] CloseHandle (hObject=0x228) returned 1 [0093.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.png", lpFilePart=0x0) returned 0x3c [0093.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.718] GetFileType (hFile=0x228) returned 0x1 [0093.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0093.718] GetFileType (hFile=0x228) returned 0x1 [0093.719] WriteFile (in: hFile=0x228, lpBuffer=0x2265c50*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2265c50*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0093.719] CloseHandle (hObject=0x228) returned 1 [0093.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0093.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0093.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.720] GetFileType (hFile=0x228) returned 0x1 [0093.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0093.720] GetFileType (hFile=0x228) returned 0x1 [0093.720] WriteFile (in: hFile=0x228, lpBuffer=0x22697d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x22697d8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0093.721] CloseHandle (hObject=0x228) returned 1 [0093.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0093.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0093.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\History\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\history\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.722] GetFileType (hFile=0x228) returned 0x1 [0093.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0093.722] GetFileType (hFile=0x228) returned 0x1 [0093.723] WriteFile (in: hFile=0x228, lpBuffer=0x226c1d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x226c1d8*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0093.723] CloseHandle (hObject=0x228) returned 1 [0093.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0093.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0093.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0093.724] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.725] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.726] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0093.726] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0093.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0093.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0093.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft", lpFilePart=0x0) returned 0x35 [0093.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\", lpFilePart=0x0) returned 0x36 [0093.727] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.727] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.728] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0093.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0093.729] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0093.729] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0093.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0093.729] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42 [0093.729] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.729] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.730] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.730] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x41 [0093.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x42 [0093.730] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.730] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.730] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0093.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.732] GetFileType (hFile=0x228) returned 0x1 [0093.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.732] GetFileType (hFile=0x228) returned 0x1 [0093.732] WriteFile (in: hFile=0x228, lpBuffer=0x227edb8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x227edb8*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0093.733] CloseHandle (hObject=0x228) returned 1 [0093.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.png", lpFilePart=0x0) returned 0x4a [0093.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.734] GetFileType (hFile=0x228) returned 0x1 [0093.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.734] GetFileType (hFile=0x228) returned 0x1 [0093.734] WriteFile (in: hFile=0x228, lpBuffer=0x227fe80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x227fe80*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0093.735] CloseHandle (hObject=0x228) returned 1 [0093.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0093.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.735] GetFileType (hFile=0x228) returned 0x1 [0093.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.735] GetFileType (hFile=0x228) returned 0x1 [0093.735] WriteFile (in: hFile=0x228, lpBuffer=0x2283a50*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2283a50*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0093.736] CloseHandle (hObject=0x228) returned 1 [0093.736] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0093.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Credentials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\credentials\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.738] GetFileType (hFile=0x228) returned 0x1 [0093.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.738] GetFileType (hFile=0x228) returned 0x1 [0093.738] WriteFile (in: hFile=0x228, lpBuffer=0x2286480*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2286480*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0093.739] CloseHandle (hObject=0x228) returned 1 [0093.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0093.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43 [0093.739] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.740] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.740] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.740] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.740] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x42 [0093.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x43 [0093.740] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.740] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.740] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.741] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.741] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.TXT", lpFilePart=0x0) returned 0x4b [0093.741] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.741] GetFileType (hFile=0x228) returned 0x1 [0093.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.741] GetFileType (hFile=0x228) returned 0x1 [0093.742] WriteFile (in: hFile=0x228, lpBuffer=0x22927f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22927f8*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0093.742] CloseHandle (hObject=0x228) returned 1 [0093.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.png", lpFilePart=0x0) returned 0x4b [0093.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.743] GetFileType (hFile=0x228) returned 0x1 [0093.743] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.743] GetFileType (hFile=0x228) returned 0x1 [0093.743] WriteFile (in: hFile=0x228, lpBuffer=0x22938c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22938c0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0093.744] CloseHandle (hObject=0x228) returned 1 [0093.744] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.vbs", lpFilePart=0x0) returned 0x4b [0093.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.744] GetFileType (hFile=0x228) returned 0x1 [0093.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.744] GetFileType (hFile=0x228) returned 0x1 [0093.745] WriteFile (in: hFile=0x228, lpBuffer=0x2297490*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2297490*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0093.745] CloseHandle (hObject=0x228) returned 1 [0093.745] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x77 [0093.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.745] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\event viewer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.747] GetFileType (hFile=0x228) returned 0x1 [0093.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.747] GetFileType (hFile=0x228) returned 0x1 [0093.747] WriteFile (in: hFile=0x228, lpBuffer=0x2299ec0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2299ec0*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0093.748] CloseHandle (hObject=0x228) returned 1 [0093.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0093.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c [0093.748] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.768] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds", lpFilePart=0x0) returned 0x3b [0093.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\", lpFilePart=0x0) returned 0x3c [0093.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.770] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.770] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.771] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0093.772] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.773] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed840, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.773] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d [0093.774] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.783] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.784] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.784] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.785] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.785] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.785] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.785] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.786] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpFilePart=0x0) returned 0x4c [0093.786] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.787] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed840, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.787] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpFilePart=0x0) returned 0x4d [0093.788] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.789] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.790] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.790] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.790] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.790] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.790] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.790] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.793] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.TXT", lpFilePart=0x0) returned 0x55 [0093.793] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.TXT", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.794] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.796] GetFileType (hFile=0x228) returned 0x1 [0093.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.796] GetFileType (hFile=0x228) returned 0x1 [0093.796] WriteFile (in: hFile=0x228, lpBuffer=0x22aa630*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22aa630*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0093.799] CloseHandle (hObject=0x228) returned 1 [0093.799] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed7a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.png", lpFilePart=0x0) returned 0x55 [0093.800] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.png", lpszLongPath=0x2ed7a0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.800] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed720, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0093.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.801] GetFileType (hFile=0x228) returned 0x1 [0093.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0093.801] GetFileType (hFile=0x228) returned 0x1 [0093.801] WriteFile (in: hFile=0x228, lpBuffer=0x22ab710*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22ab710*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0093.802] CloseHandle (hObject=0x228) returned 1 [0093.802] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.vbs", lpFilePart=0x0) returned 0x55 [0093.803] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.vbs", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.803] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.804] GetFileType (hFile=0x228) returned 0x1 [0093.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.804] GetFileType (hFile=0x228) returned 0x1 [0093.804] WriteFile (in: hFile=0x228, lpBuffer=0x22af328*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x22af328*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0093.805] CloseHandle (hObject=0x228) returned 1 [0093.805] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\") returned 0x4d [0093.805] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x81 [0093.805] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.805] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~", lpszLongPath=0x2ed600, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~") returned 0x4c [0093.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.806] GetFileType (hFile=0x228) returned 0x1 [0093.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.806] GetFileType (hFile=0x228) returned 0x1 [0093.806] WriteFile (in: hFile=0x228, lpBuffer=0x22b1d88*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22b1d88*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0093.807] CloseHandle (hObject=0x228) returned 1 [0093.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.807] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.808] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0093.808] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.808] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed840, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.808] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64 [0093.809] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.810] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.810] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.810] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.811] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.811] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.811] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpFilePart=0x0) returned 0x63 [0093.811] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed870, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.812] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed840, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.812] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpFilePart=0x0) returned 0x64 [0093.813] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed810, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.814] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.814] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.815] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.815] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed7f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.815] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed7f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.816] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0093.816] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed7f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.816] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed7c0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.817] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed7c0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.817] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed790, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.818] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed790, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.818] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f [0093.818] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed790, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.819] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.819] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.820] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.820] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0093.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0093.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.820] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed7f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.821] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed7f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.821] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpFilePart=0x0) returned 0x6e [0093.821] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed7f0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.821] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed7c0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.822] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed7c0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.822] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed790, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.823] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed790, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpFilePart=0x0) returned 0x6f [0093.823] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed790, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.824] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0093.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0093.825] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0093.825] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0093.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0093.826] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.827] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.TXT", lpFilePart=0x0) returned 0x77 [0093.827] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.TXT", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.828] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed5e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0093.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0093.830] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed720, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.831] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed720, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.png", lpFilePart=0x0) returned 0x77 [0093.832] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.png", lpszLongPath=0x2ed720, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.832] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed6a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0093.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0093.834] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.834] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.vbs", lpFilePart=0x0) returned 0x77 [0093.835] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.vbs", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.835] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed5e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0093.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0093.836] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.837] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\") returned 0x6f [0093.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa3 [0093.837] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.837] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~", lpszLongPath=0x2ed580, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~") returned 0x6e [0093.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0093.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0093.839] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.TXT", lpFilePart=0x0) returned 0x6c [0093.839] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.TXT", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.839] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.841] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed7a0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.png", lpFilePart=0x0) returned 0x6c [0093.841] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.png", lpszLongPath=0x2ed7a0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.841] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed720, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0093.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0093.843] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.vbs", lpFilePart=0x0) returned 0x6c [0093.844] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.vbs", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.844] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed660, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.847] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\") returned 0x64 [0093.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x98 [0093.847] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpszLongPath=0x2ed6e0, cchBuffer=0x104 | out: lpszLongPath="") returned 0x0 [0093.847] GetLongPathNameW (in: lpszShortPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", lpszLongPath=0x2ed600, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~") returned 0x63 [0093.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.848] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0093.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.png", lpFilePart=0x0) returned 0x44 [0093.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0093.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0093.852] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0093.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42 [0093.854] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.857] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.857] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.858] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.858] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.859] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.859] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache", lpFilePart=0x0) returned 0x41 [0093.859] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\", lpFilePart=0x0) returned 0x42 [0093.859] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.860] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.861] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.861] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0093.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b [0093.862] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.862] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.862] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.863] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.863] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.863] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR", lpFilePart=0x0) returned 0x4a [0093.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\", lpFilePart=0x0) returned 0x4b [0093.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.863] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.863] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.863] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.863] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.863] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0093.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.png", lpFilePart=0x0) returned 0x53 [0093.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0093.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0093.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0093.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0093.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0093.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b [0093.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.870] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.870] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7", lpFilePart=0x0) returned 0x4a [0093.870] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\", lpFilePart=0x0) returned 0x4b [0093.870] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.871] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.871] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.871] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0093.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.872] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.png", lpFilePart=0x0) returned 0x53 [0093.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0093.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.872] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0093.873] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0093.873] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0093.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0093.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b [0093.888] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.888] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.888] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.888] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ", lpFilePart=0x0) returned 0x4a [0093.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\", lpFilePart=0x0) returned 0x4b [0093.889] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.889] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.889] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0093.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.png", lpFilePart=0x0) returned 0x53 [0093.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0093.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0093.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0093.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0093.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0093.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b [0093.895] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.896] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0093.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD", lpFilePart=0x0) returned 0x4a [0093.896] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\", lpFilePart=0x0) returned 0x4b [0093.896] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0093.896] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0093.896] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0093.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0093.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0093.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.png", lpFilePart=0x0) returned 0x53 [0093.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0093.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.899] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0093.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0093.900] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.900] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0093.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0093.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0093.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0093.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.908] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.png", lpFilePart=0x0) returned 0x4a [0093.908] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.908] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0093.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.911] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0093.911] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0093.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c [0093.912] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.912] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.912] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS", lpFilePart=0x0) returned 0x3b [0093.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\", lpFilePart=0x0) returned 0x3c [0093.913] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.913] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.913] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.913] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0093.913] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.913] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.png", lpFilePart=0x0) returned 0x44 [0093.914] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.915] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.915] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0093.915] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0093.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0093.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c [0093.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.929] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.929] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3b [0093.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3c [0093.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.930] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.930] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0093.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.png", lpFilePart=0x0) returned 0x44 [0093.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0093.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0093.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\ime12\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0093.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d [0093.935] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.935] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.936] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.936] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3c [0093.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x3d [0093.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.936] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.936] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.936] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.TXT", lpFilePart=0x0) returned 0x45 [0093.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.938] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.png", lpFilePart=0x0) returned 0x45 [0093.938] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.938] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.vbs", lpFilePart=0x0) returned 0x45 [0093.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x71 [0093.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.940] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp12\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0093.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e [0093.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.942] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x3d [0093.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x3e [0093.943] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.943] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.943] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.TXT", lpFilePart=0x0) returned 0x46 [0093.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.png", lpFilePart=0x0) returned 0x46 [0093.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.945] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.vbs", lpFilePart=0x0) returned 0x46 [0093.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x72 [0093.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP8_1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp8_1\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0093.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e [0093.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.950] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.950] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x3d [0093.950] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x3e [0093.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.951] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.951] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.TXT", lpFilePart=0x0) returned 0x46 [0093.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.png", lpFilePart=0x0) returned 0x46 [0093.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0093.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0093.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.vbs", lpFilePart=0x0) returned 0x46 [0093.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x72 [0093.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0093.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\IMJP9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\imjp9_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0093.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0093.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0093.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48 [0093.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.965] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.965] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0093.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x47 [0093.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x48 [0093.966] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0093.967] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0093.967] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0093.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0093.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0093.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53 [0093.968] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", dwFileAttributes=0x80) returned 1 [0093.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.Horsuke", lpFilePart=0x0) returned 0x5b [0093.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0093.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0093.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53 [0094.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0094.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0094.476] GetFileType (hFile=0x15c) returned 0x1 [0094.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.476] GetFileType (hFile=0x15c) returned 0x1 [0094.476] ReadFile (in: hFile=0x15c, lpBuffer=0x22a4320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a4320*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0094.495] ReadFile (in: hFile=0x15c, lpBuffer=0x22a4320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a4320*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0094.496] ReadFile (in: hFile=0x15c, lpBuffer=0x22a4320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a4320*, lpNumberOfBytesRead=0x2edde8*=0xfb0, lpOverlapped=0x0) returned 1 [0094.496] ReadFile (in: hFile=0x15c, lpBuffer=0x22a42b8, nNumberOfBytesToRead=0x50, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a42b8*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0094.496] ReadFile (in: hFile=0x15c, lpBuffer=0x22a4320, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a4320*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0094.496] CloseHandle (hObject=0x15c) returned 1 [0094.496] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt", lpFilePart=0x0) returned 0x53 [0094.497] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0094.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0094.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0094.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51 [0094.497] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.499] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0094.499] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0094.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0094.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0094.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x50 [0094.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x51 [0094.500] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0094.500] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0094.500] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0094.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0094.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0094.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a [0094.501] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.501] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3", lpFilePart=0x0) returned 0x59 [0094.501] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\", lpFilePart=0x0) returned 0x5a [0094.501] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.502] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.502] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.TXT", lpFilePart=0x0) returned 0x62 [0094.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.505] GetFileType (hFile=0x228) returned 0x1 [0094.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.505] GetFileType (hFile=0x228) returned 0x1 [0094.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.png", lpFilePart=0x0) returned 0x62 [0094.506] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0094.506] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0094.507] GetFileType (hFile=0x228) returned 0x1 [0094.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0094.507] GetFileType (hFile=0x228) returned 0x1 [0094.507] WriteFile (in: hFile=0x228, lpBuffer=0x22b87b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22b87b8*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0094.508] CloseHandle (hObject=0x228) returned 1 [0094.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.vbs", lpFilePart=0x0) returned 0x62 [0094.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.508] GetFileType (hFile=0x228) returned 0x1 [0094.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.508] GetFileType (hFile=0x228) returned 0x1 [0094.509] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8e [0094.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.509] GetFileType (hFile=0x228) returned 0x1 [0094.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.509] GetFileType (hFile=0x228) returned 0x1 [0094.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0094.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a [0094.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.511] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33", lpFilePart=0x0) returned 0x59 [0094.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\", lpFilePart=0x0) returned 0x5a [0094.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.512] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.512] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFilePart=0x0) returned 0x6a [0094.512] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", dwFileAttributes=0x80) returned 1 [0094.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.Horsuke", lpFilePart=0x0) returned 0x72 [0094.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0094.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0094.513] GetFileType (hFile=0x228) returned 0x1 [0094.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0094.513] GetFileType (hFile=0x228) returned 0x1 [0094.971] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFilePart=0x0) returned 0x6a [0094.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0094.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0094.972] GetFileType (hFile=0x15c) returned 0x1 [0094.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0094.972] GetFileType (hFile=0x15c) returned 0x1 [0094.972] ReadFile (in: hFile=0x15c, lpBuffer=0x23aad30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23aad30*, lpNumberOfBytesRead=0x2edce8*=0xd, lpOverlapped=0x0) returned 1 [0094.973] ReadFile (in: hFile=0x15c, lpBuffer=0x23aad30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23aad30*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0094.973] CloseHandle (hObject=0x15c) returned 1 [0094.973] WriteFile (in: hFile=0x228, lpBuffer=0x23a91e0*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x23a91e0*, lpNumberOfBytesWritten=0x2edbb8*=0x30, lpOverlapped=0x0) returned 1 [0094.974] CloseHandle (hObject=0x228) returned 1 [0094.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", lpFilePart=0x0) returned 0x6a [0094.974] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 1 [0094.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.TXT", lpFilePart=0x0) returned 0x62 [0094.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.977] GetFileType (hFile=0x228) returned 0x1 [0094.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.977] GetFileType (hFile=0x228) returned 0x1 [0094.978] WriteFile (in: hFile=0x228, lpBuffer=0x23b5208*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23b5208*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0094.978] CloseHandle (hObject=0x228) returned 1 [0094.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.png", lpFilePart=0x0) returned 0x62 [0094.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0094.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0094.979] GetFileType (hFile=0x228) returned 0x1 [0094.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0094.979] GetFileType (hFile=0x228) returned 0x1 [0094.979] WriteFile (in: hFile=0x228, lpBuffer=0x23b6300*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23b6300*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0094.980] CloseHandle (hObject=0x228) returned 1 [0094.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.vbs", lpFilePart=0x0) returned 0x62 [0094.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.980] GetFileType (hFile=0x228) returned 0x1 [0094.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.980] GetFileType (hFile=0x228) returned 0x1 [0094.980] WriteFile (in: hFile=0x228, lpBuffer=0x23b9f60*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x23b9f60*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0094.981] CloseHandle (hObject=0x228) returned 1 [0094.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8e [0094.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.983] GetFileType (hFile=0x228) returned 0x1 [0094.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.983] GetFileType (hFile=0x228) returned 0x1 [0094.983] WriteFile (in: hFile=0x228, lpBuffer=0x23bc9f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23bc9f0*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0094.984] CloseHandle (hObject=0x228) returned 1 [0094.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0094.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a [0094.984] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.984] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.985] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0", lpFilePart=0x0) returned 0x59 [0094.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\", lpFilePart=0x0) returned 0x5a [0094.985] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.985] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.985] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.TXT", lpFilePart=0x0) returned 0x62 [0094.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.988] GetFileType (hFile=0x228) returned 0x1 [0094.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.988] GetFileType (hFile=0x228) returned 0x1 [0094.988] WriteFile (in: hFile=0x228, lpBuffer=0x23c9238*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23c9238*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0094.989] CloseHandle (hObject=0x228) returned 1 [0094.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.png", lpFilePart=0x0) returned 0x62 [0094.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0094.989] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0094.990] GetFileType (hFile=0x228) returned 0x1 [0094.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0094.990] GetFileType (hFile=0x228) returned 0x1 [0094.990] WriteFile (in: hFile=0x228, lpBuffer=0x23ca330*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23ca330*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0094.991] CloseHandle (hObject=0x228) returned 1 [0094.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.vbs", lpFilePart=0x0) returned 0x62 [0094.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.991] GetFileType (hFile=0x228) returned 0x1 [0094.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.991] GetFileType (hFile=0x228) returned 0x1 [0094.991] WriteFile (in: hFile=0x228, lpBuffer=0x23cdf90*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x23cdf90*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0094.992] CloseHandle (hObject=0x228) returned 1 [0094.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8e [0094.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\fkluidu0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.993] GetFileType (hFile=0x228) returned 0x1 [0094.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.993] GetFileType (hFile=0x228) returned 0x1 [0094.993] WriteFile (in: hFile=0x228, lpBuffer=0x23d0a20*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23d0a20*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0094.993] CloseHandle (hObject=0x228) returned 1 [0094.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0094.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a [0094.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.994] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0094.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC", lpFilePart=0x0) returned 0x59 [0094.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\", lpFilePart=0x0) returned 0x5a [0094.994] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0094.994] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0094.995] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0094.995] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0094.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0094.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0094.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.TXT", lpFilePart=0x0) returned 0x62 [0094.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.995] GetFileType (hFile=0x228) returned 0x1 [0094.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.996] GetFileType (hFile=0x228) returned 0x1 [0094.996] WriteFile (in: hFile=0x228, lpBuffer=0x23dd268*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23dd268*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0094.997] CloseHandle (hObject=0x228) returned 1 [0094.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.png", lpFilePart=0x0) returned 0x62 [0094.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0094.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0094.997] GetFileType (hFile=0x228) returned 0x1 [0094.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0094.997] GetFileType (hFile=0x228) returned 0x1 [0094.998] WriteFile (in: hFile=0x228, lpBuffer=0x23de360*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23de360*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0094.998] CloseHandle (hObject=0x228) returned 1 [0094.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.vbs", lpFilePart=0x0) returned 0x62 [0094.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0094.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0094.999] GetFileType (hFile=0x228) returned 0x1 [0094.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0094.999] GetFileType (hFile=0x228) returned 0x1 [0094.999] WriteFile (in: hFile=0x228, lpBuffer=0x23e1fc0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x23e1fc0*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0095.000] CloseHandle (hObject=0x228) returned 1 [0095.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8e [0095.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\owlvmzrc\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.001] GetFileType (hFile=0x228) returned 0x1 [0095.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.001] GetFileType (hFile=0x228) returned 0x1 [0095.001] WriteFile (in: hFile=0x228, lpBuffer=0x23e4a50*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23e4a50*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0095.002] CloseHandle (hObject=0x228) returned 1 [0095.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.TXT", lpFilePart=0x0) returned 0x59 [0095.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.003] GetFileType (hFile=0x228) returned 0x1 [0095.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.003] GetFileType (hFile=0x228) returned 0x1 [0095.003] WriteFile (in: hFile=0x228, lpBuffer=0x23eeda8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x23eeda8*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0095.004] CloseHandle (hObject=0x228) returned 1 [0095.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.png", lpFilePart=0x0) returned 0x59 [0095.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.011] GetFileType (hFile=0x228) returned 0x1 [0095.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.011] GetFileType (hFile=0x228) returned 0x1 [0095.011] WriteFile (in: hFile=0x228, lpBuffer=0x23efe90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x23efe90*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.012] CloseHandle (hObject=0x228) returned 1 [0095.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.vbs", lpFilePart=0x0) returned 0x59 [0095.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.012] GetFileType (hFile=0x228) returned 0x1 [0095.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.013] GetFileType (hFile=0x228) returned 0x1 [0095.013] WriteFile (in: hFile=0x228, lpBuffer=0x23f3ac0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x23f3ac0*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0095.013] CloseHandle (hObject=0x228) returned 1 [0095.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x85 [0095.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.014] GetFileType (hFile=0x228) returned 0x1 [0095.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.014] GetFileType (hFile=0x228) returned 0x1 [0095.014] WriteFile (in: hFile=0x228, lpBuffer=0x23f6530*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x23f6530*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0095.015] CloseHandle (hObject=0x228) returned 1 [0095.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0095.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51 [0095.015] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.015] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.015] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.016] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.016] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.016] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery", lpFilePart=0x0) returned 0x50 [0095.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\", lpFilePart=0x0) returned 0x51 [0095.016] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.016] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.016] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.016] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.016] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.017] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0095.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58 [0095.017] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.017] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.017] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.017] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active", lpFilePart=0x0) returned 0x57 [0095.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\", lpFilePart=0x0) returned 0x58 [0095.018] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.018] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.018] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.018] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.018] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0095.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.019] GetFileType (hFile=0x228) returned 0x1 [0095.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.019] GetFileType (hFile=0x228) returned 0x1 [0095.019] WriteFile (in: hFile=0x228, lpBuffer=0x2405980*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x2405980*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0095.020] CloseHandle (hObject=0x228) returned 1 [0095.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.png", lpFilePart=0x0) returned 0x60 [0095.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0095.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.020] GetFileType (hFile=0x228) returned 0x1 [0095.020] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0095.020] GetFileType (hFile=0x228) returned 0x1 [0095.020] WriteFile (in: hFile=0x228, lpBuffer=0x2406a78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x2406a78*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0095.021] CloseHandle (hObject=0x228) returned 1 [0095.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0095.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.022] GetFileType (hFile=0x228) returned 0x1 [0095.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.022] GetFileType (hFile=0x228) returned 0x1 [0095.022] WriteFile (in: hFile=0x228, lpBuffer=0x240a6d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x240a6d8*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0095.023] CloseHandle (hObject=0x228) returned 1 [0095.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0095.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Active\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\active\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.024] GetFileType (hFile=0x228) returned 0x1 [0095.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.024] GetFileType (hFile=0x228) returned 0x1 [0095.024] WriteFile (in: hFile=0x228, lpBuffer=0x240d168*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x240d168*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0095.025] CloseHandle (hObject=0x228) returned 1 [0095.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0095.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d [0095.025] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.030] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.030] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active", lpFilePart=0x0) returned 0x5c [0095.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\", lpFilePart=0x0) returned 0x5d [0095.031] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.032] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.032] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.032] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.032] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.032] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.032] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.032] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.033] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0095.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.034] GetFileType (hFile=0x228) returned 0x1 [0095.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.034] GetFileType (hFile=0x228) returned 0x1 [0095.035] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.png", lpFilePart=0x0) returned 0x65 [0095.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0095.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.035] GetFileType (hFile=0x228) returned 0x1 [0095.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0095.035] GetFileType (hFile=0x228) returned 0x1 [0095.035] WriteFile (in: hFile=0x228, lpBuffer=0x241c890*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x241c890*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0095.036] CloseHandle (hObject=0x228) returned 1 [0095.036] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0095.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.037] GetFileType (hFile=0x228) returned 0x1 [0095.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.037] GetFileType (hFile=0x228) returned 0x1 [0095.037] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0095.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.038] GetFileType (hFile=0x228) returned 0x1 [0095.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.038] GetFileType (hFile=0x228) returned 0x1 [0095.039] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.TXT", lpFilePart=0x0) returned 0x59 [0095.039] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.039] GetFileType (hFile=0x228) returned 0x1 [0095.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.039] GetFileType (hFile=0x228) returned 0x1 [0095.040] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.png", lpFilePart=0x0) returned 0x59 [0095.040] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.041] GetFileType (hFile=0x228) returned 0x1 [0095.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.041] GetFileType (hFile=0x228) returned 0x1 [0095.041] WriteFile (in: hFile=0x228, lpBuffer=0x242e3e8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x242e3e8*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.vbs", lpFilePart=0x0) returned 0x59 [0095.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.043] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x85 [0095.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.060] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0095.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.060] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.061] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.png", lpFilePart=0x0) returned 0x50 [0095.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0095.063] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0095.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.064] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0095.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.065] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0095.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0095.065] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43 [0095.065] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0095.067] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.067] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.067] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.067] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.068] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.068] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0095.068] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0095.069] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0095.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0095.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x42 [0095.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x43 [0095.069] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0095.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0095.070] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0095.071] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0095.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0095.071] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52 [0095.071] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.072] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists", lpFilePart=0x0) returned 0x51 [0095.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\", lpFilePart=0x0) returned 0x52 [0095.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.073] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0095.074] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58 [0095.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.074] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US", lpFilePart=0x0) returned 0x57 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\", lpFilePart=0x0) returned 0x58 [0095.075] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.075] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.075] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", lpFilePart=0x0) returned 0x60 [0095.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", lpFilePart=0x0) returned 0x61 [0095.076] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0095.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.149] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.150] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0095.150] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0095.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0095.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713", lpFilePart=0x0) returned 0x60 [0095.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\", lpFilePart=0x0) returned 0x61 [0095.151] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0095.152] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.152] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.152] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.152] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.153] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0095.154] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0095.154] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0095.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0095.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0095.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0095.158] WriteFile (in: hFile=0x228, lpBuffer=0x22613f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x22613f8*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0095.159] CloseHandle (hObject=0x228) returned 1 [0095.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.png", lpFilePart=0x0) returned 0x69 [0095.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0095.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.160] GetFileType (hFile=0x228) returned 0x1 [0095.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0095.160] GetFileType (hFile=0x228) returned 0x1 [0095.160] WriteFile (in: hFile=0x228, lpBuffer=0x2262500*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x2262500*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.161] CloseHandle (hObject=0x228) returned 1 [0095.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0095.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0095.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.162] GetFileType (hFile=0x228) returned 0x1 [0095.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0095.162] GetFileType (hFile=0x228) returned 0x1 [0095.162] WriteFile (in: hFile=0x228, lpBuffer=0x2266190*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2266190*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0095.163] CloseHandle (hObject=0x228) returned 1 [0095.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0095.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0095.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.163] GetFileType (hFile=0x228) returned 0x1 [0095.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0095.163] GetFileType (hFile=0x228) returned 0x1 [0095.163] WriteFile (in: hFile=0x228, lpBuffer=0x2268c40*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2268c40*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0095.164] CloseHandle (hObject=0x228) returned 1 [0095.164] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x60 [0095.164] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x61 [0095.164] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0095.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0095.323] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0095.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0095.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E", lpFilePart=0x0) returned 0x60 [0095.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\", lpFilePart=0x0) returned 0x61 [0095.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0095.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0095.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0095.326] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0095.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0095.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0095.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0095.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.328] GetFileType (hFile=0x228) returned 0x1 [0095.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0095.328] GetFileType (hFile=0x228) returned 0x1 [0095.328] WriteFile (in: hFile=0x228, lpBuffer=0x227a408*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x227a408*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0095.329] CloseHandle (hObject=0x228) returned 1 [0095.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.png", lpFilePart=0x0) returned 0x69 [0095.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0095.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.330] GetFileType (hFile=0x228) returned 0x1 [0095.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0095.330] GetFileType (hFile=0x228) returned 0x1 [0095.330] WriteFile (in: hFile=0x228, lpBuffer=0x227b510*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x227b510*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.331] CloseHandle (hObject=0x228) returned 1 [0095.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0095.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0095.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.332] GetFileType (hFile=0x228) returned 0x1 [0095.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0095.332] GetFileType (hFile=0x228) returned 0x1 [0095.332] WriteFile (in: hFile=0x228, lpBuffer=0x227f1a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x227f1a0*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0095.333] CloseHandle (hObject=0x228) returned 1 [0095.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0095.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0095.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.333] GetFileType (hFile=0x228) returned 0x1 [0095.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0095.333] GetFileType (hFile=0x228) returned 0x1 [0095.333] WriteFile (in: hFile=0x228, lpBuffer=0x2281c50*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2281c50*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0095.334] CloseHandle (hObject=0x228) returned 1 [0095.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0095.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.335] GetFileType (hFile=0x228) returned 0x1 [0095.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.335] GetFileType (hFile=0x228) returned 0x1 [0095.335] WriteFile (in: hFile=0x228, lpBuffer=0x228bfc8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x228bfc8*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0095.336] CloseHandle (hObject=0x228) returned 1 [0095.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.png", lpFilePart=0x0) returned 0x60 [0095.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0095.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.336] GetFileType (hFile=0x228) returned 0x1 [0095.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0095.336] GetFileType (hFile=0x228) returned 0x1 [0095.336] WriteFile (in: hFile=0x228, lpBuffer=0x228d0c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x228d0c0*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0095.337] CloseHandle (hObject=0x228) returned 1 [0095.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0095.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.338] GetFileType (hFile=0x228) returned 0x1 [0095.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.338] GetFileType (hFile=0x228) returned 0x1 [0095.338] WriteFile (in: hFile=0x228, lpBuffer=0x2290d20*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x2290d20*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0095.338] CloseHandle (hObject=0x228) returned 1 [0095.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0095.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.340] GetFileType (hFile=0x228) returned 0x1 [0095.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.340] GetFileType (hFile=0x228) returned 0x1 [0095.341] WriteFile (in: hFile=0x228, lpBuffer=0x22937b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22937b0*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0095.341] CloseHandle (hObject=0x228) returned 1 [0095.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0095.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.342] GetFileType (hFile=0x228) returned 0x1 [0095.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.342] GetFileType (hFile=0x228) returned 0x1 [0095.342] WriteFile (in: hFile=0x228, lpBuffer=0x229db08*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x229db08*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0095.343] CloseHandle (hObject=0x228) returned 1 [0095.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.png", lpFilePart=0x0) returned 0x5a [0095.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.345] GetFileType (hFile=0x228) returned 0x1 [0095.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.345] GetFileType (hFile=0x228) returned 0x1 [0095.345] WriteFile (in: hFile=0x228, lpBuffer=0x229ebf0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x229ebf0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.346] CloseHandle (hObject=0x228) returned 1 [0095.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0095.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.346] GetFileType (hFile=0x228) returned 0x1 [0095.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.346] GetFileType (hFile=0x228) returned 0x1 [0095.346] WriteFile (in: hFile=0x228, lpBuffer=0x22a2820*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x22a2820*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0095.347] CloseHandle (hObject=0x228) returned 1 [0095.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0095.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.349] GetFileType (hFile=0x228) returned 0x1 [0095.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.349] GetFileType (hFile=0x228) returned 0x1 [0095.349] WriteFile (in: hFile=0x228, lpBuffer=0x22a5290*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22a5290*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0095.350] CloseHandle (hObject=0x228) returned 1 [0095.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0095.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a [0095.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.350] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.351] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache", lpFilePart=0x0) returned 0x59 [0095.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\", lpFilePart=0x0) returned 0x5a [0095.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.351] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.TXT", lpFilePart=0x0) returned 0x62 [0095.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.351] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.352] GetFileType (hFile=0x228) returned 0x1 [0095.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.352] GetFileType (hFile=0x228) returned 0x1 [0095.352] WriteFile (in: hFile=0x228, lpBuffer=0x22b1ad8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22b1ad8*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0095.353] CloseHandle (hObject=0x228) returned 1 [0095.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.png", lpFilePart=0x0) returned 0x62 [0095.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.354] GetFileType (hFile=0x228) returned 0x1 [0095.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.354] GetFileType (hFile=0x228) returned 0x1 [0095.354] WriteFile (in: hFile=0x228, lpBuffer=0x22b2bd0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22b2bd0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.355] CloseHandle (hObject=0x228) returned 1 [0095.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.vbs", lpFilePart=0x0) returned 0x62 [0095.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.355] GetFileType (hFile=0x228) returned 0x1 [0095.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.355] GetFileType (hFile=0x228) returned 0x1 [0095.355] WriteFile (in: hFile=0x228, lpBuffer=0x22b6830*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x22b6830*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0095.356] CloseHandle (hObject=0x228) returned 1 [0095.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8e [0095.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Transcoded Files Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\transcoded files cache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.358] GetFileType (hFile=0x228) returned 0x1 [0095.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.358] GetFileType (hFile=0x228) returned 0x1 [0095.358] WriteFile (in: hFile=0x228, lpBuffer=0x22b92c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22b92c0*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0095.359] CloseHandle (hObject=0x228) returned 1 [0095.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.TXT", lpFilePart=0x0) returned 0x4b [0095.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.359] GetFileType (hFile=0x228) returned 0x1 [0095.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.359] GetFileType (hFile=0x228) returned 0x1 [0095.360] WriteFile (in: hFile=0x228, lpBuffer=0x22c35d8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22c35d8*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0095.361] CloseHandle (hObject=0x228) returned 1 [0095.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.png", lpFilePart=0x0) returned 0x4b [0095.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.361] GetFileType (hFile=0x228) returned 0x1 [0095.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0095.361] GetFileType (hFile=0x228) returned 0x1 [0095.361] WriteFile (in: hFile=0x228, lpBuffer=0x22c46a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22c46a0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0095.362] CloseHandle (hObject=0x228) returned 1 [0095.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.vbs", lpFilePart=0x0) returned 0x4b [0095.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.363] GetFileType (hFile=0x228) returned 0x1 [0095.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.363] GetFileType (hFile=0x228) returned 0x1 [0095.363] WriteFile (in: hFile=0x228, lpBuffer=0x22c8270*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22c8270*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0095.364] CloseHandle (hObject=0x228) returned 1 [0095.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x77 [0095.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.364] GetFileType (hFile=0x228) returned 0x1 [0095.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.364] GetFileType (hFile=0x228) returned 0x1 [0095.364] WriteFile (in: hFile=0x228, lpBuffer=0x22caca0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22caca0*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0095.365] CloseHandle (hObject=0x228) returned 1 [0095.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0095.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0095.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d [0095.365] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0095.365] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0095.366] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0095.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0095.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0095.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office", lpFilePart=0x0) returned 0x3c [0095.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3d [0095.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.366] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0095.366] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0095.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0095.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0095.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42 [0095.367] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.367] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.368] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.368] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.368] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0", lpFilePart=0x0) returned 0x41 [0095.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\", lpFilePart=0x0) returned 0x42 [0095.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.368] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.368] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.368] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.368] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0095.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52 [0095.368] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.369] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.369] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.369] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.369] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.369] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.370] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache", lpFilePart=0x0) returned 0x51 [0095.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\", lpFilePart=0x0) returned 0x52 [0095.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.370] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0095.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.png", lpFilePart=0x0) returned 0x5a [0095.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0095.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0095.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0095.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.374] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0095.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0095.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.png", lpFilePart=0x0) returned 0x4a [0095.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0095.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0095.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0095.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44 [0095.382] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.382] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.383] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove", lpFilePart=0x0) returned 0x43 [0095.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\", lpFilePart=0x0) returned 0x44 [0095.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.383] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.383] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0095.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b [0095.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.384] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System", lpFilePart=0x0) returned 0x4a [0095.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\", lpFilePart=0x0) returned 0x4b [0095.384] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.384] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.385] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.385] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0095.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.386] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.png", lpFilePart=0x0) returned 0x53 [0095.386] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0095.386] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0095.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0095.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.389] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0095.389] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\System\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\system\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0095.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49 [0095.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.391] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.391] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.391] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User", lpFilePart=0x0) returned 0x48 [0095.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\", lpFilePart=0x0) returned 0x49 [0095.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0095.391] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0095.391] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0095.391] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0095.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0095.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.TXT", lpFilePart=0x0) returned 0x51 [0095.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.png", lpFilePart=0x0) returned 0x51 [0095.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0095.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0095.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.vbs", lpFilePart=0x0) returned 0x51 [0095.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7d [0095.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0095.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\User\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\user\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0095.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0095.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.png", lpFilePart=0x0) returned 0x4c [0095.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0095.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0095.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Groove\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\groove\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0095.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48 [0095.402] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.402] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.402] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.402] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.402] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.402] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig", lpFilePart=0x0) returned 0x47 [0095.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\", lpFilePart=0x0) returned 0x48 [0095.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.403] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFilePart=0x0) returned 0x6c [0095.403] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", dwFileAttributes=0x80) returned 1 [0095.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.Horsuke", lpFilePart=0x0) returned 0x74 [0095.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFilePart=0x0) returned 0x6c [0095.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0095.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0095.936] GetFileType (hFile=0x15c) returned 0x1 [0095.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0095.936] GetFileType (hFile=0x15c) returned 0x1 [0095.936] ReadFile (in: hFile=0x15c, lpBuffer=0x241df38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x241df38*, lpNumberOfBytesRead=0x2edd68*=0x7ef, lpOverlapped=0x0) returned 1 [0095.959] ReadFile (in: hFile=0x15c, lpBuffer=0x241df0f, nNumberOfBytesToRead=0x11, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x241df0f*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0095.960] ReadFile (in: hFile=0x15c, lpBuffer=0x241df38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x241df38*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0095.960] CloseHandle (hObject=0x15c) returned 1 [0095.961] WriteFile (in: hFile=0x228, lpBuffer=0x241c3b8*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x241c3b8*, lpNumberOfBytesWritten=0x2edc38*=0x810, lpOverlapped=0x0) returned 1 [0095.962] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", lpFilePart=0x0) returned 0x6c [0095.962] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 1 [0095.963] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0095.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.964] GetFileType (hFile=0x228) returned 0x1 [0095.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.964] GetFileType (hFile=0x228) returned 0x1 [0095.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.png", lpFilePart=0x0) returned 0x50 [0095.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.965] GetFileType (hFile=0x228) returned 0x1 [0095.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.965] GetFileType (hFile=0x228) returned 0x1 [0095.965] WriteFile (in: hFile=0x228, lpBuffer=0x2429cc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2429cc0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.966] CloseHandle (hObject=0x228) returned 1 [0095.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0095.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.967] GetFileType (hFile=0x228) returned 0x1 [0095.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.967] GetFileType (hFile=0x228) returned 0x1 [0095.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0095.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.968] GetFileType (hFile=0x228) returned 0x1 [0095.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.968] GetFileType (hFile=0x228) returned 0x1 [0095.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.TXT", lpFilePart=0x0) returned 0x45 [0095.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.972] GetFileType (hFile=0x228) returned 0x1 [0095.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.972] GetFileType (hFile=0x228) returned 0x1 [0095.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.png", lpFilePart=0x0) returned 0x45 [0095.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.973] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.973] GetFileType (hFile=0x228) returned 0x1 [0095.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0095.973] GetFileType (hFile=0x228) returned 0x1 [0095.973] WriteFile (in: hFile=0x228, lpBuffer=0x223c9c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x223c9c8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0095.974] CloseHandle (hObject=0x228) returned 1 [0095.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.vbs", lpFilePart=0x0) returned 0x45 [0095.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.976] GetFileType (hFile=0x228) returned 0x1 [0095.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.976] GetFileType (hFile=0x228) returned 0x1 [0095.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x71 [0095.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.977] GetFileType (hFile=0x228) returned 0x1 [0095.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.977] GetFileType (hFile=0x228) returned 0x1 [0095.978] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0095.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0095.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e [0095.978] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0095.978] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.979] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0095.979] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0095.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0095.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0095.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3d [0095.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x3e [0095.979] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0095.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0095.980] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0095.980] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0095.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0095.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0095.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48 [0095.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.981] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.981] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0095.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache", lpFilePart=0x0) returned 0x47 [0095.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\", lpFilePart=0x0) returned 0x48 [0095.981] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0095.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0095.982] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0095.982] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0095.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0095.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0095.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0095.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.985] GetFileType (hFile=0x228) returned 0x1 [0095.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.985] GetFileType (hFile=0x228) returned 0x1 [0095.985] WriteFile (in: hFile=0x228, lpBuffer=0x2252860*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2252860*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0095.986] CloseHandle (hObject=0x228) returned 1 [0095.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.png", lpFilePart=0x0) returned 0x50 [0095.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0095.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.987] GetFileType (hFile=0x228) returned 0x1 [0095.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0095.987] GetFileType (hFile=0x228) returned 0x1 [0095.987] WriteFile (in: hFile=0x228, lpBuffer=0x2253938*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2253938*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0095.988] CloseHandle (hObject=0x228) returned 1 [0095.988] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0095.988] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.990] GetFileType (hFile=0x228) returned 0x1 [0095.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.990] GetFileType (hFile=0x228) returned 0x1 [0095.990] WriteFile (in: hFile=0x228, lpBuffer=0x2257538*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x2257538*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0095.991] CloseHandle (hObject=0x228) returned 1 [0095.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0095.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0095.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.991] GetFileType (hFile=0x228) returned 0x1 [0095.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0095.991] GetFileType (hFile=0x228) returned 0x1 [0095.991] WriteFile (in: hFile=0x228, lpBuffer=0x2259f88*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2259f88*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0095.992] CloseHandle (hObject=0x228) returned 1 [0095.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.TXT", lpFilePart=0x0) returned 0x46 [0095.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.994] GetFileType (hFile=0x228) returned 0x1 [0095.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.994] GetFileType (hFile=0x228) returned 0x1 [0095.994] WriteFile (in: hFile=0x228, lpBuffer=0x2264290*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2264290*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0095.995] CloseHandle (hObject=0x228) returned 1 [0095.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.png", lpFilePart=0x0) returned 0x46 [0095.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0095.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0095.997] GetFileType (hFile=0x228) returned 0x1 [0095.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0095.997] GetFileType (hFile=0x228) returned 0x1 [0095.997] WriteFile (in: hFile=0x228, lpBuffer=0x2265350*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2265350*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0095.998] CloseHandle (hObject=0x228) returned 1 [0095.998] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.vbs", lpFilePart=0x0) returned 0x46 [0095.998] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0095.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0095.999] GetFileType (hFile=0x228) returned 0x1 [0095.999] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0095.999] GetFileType (hFile=0x228) returned 0x1 [0095.999] WriteFile (in: hFile=0x228, lpBuffer=0x2268f08*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2268f08*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0096.000] CloseHandle (hObject=0x228) returned 1 [0096.000] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x72 [0096.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.001] GetFileType (hFile=0x228) returned 0x1 [0096.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.001] GetFileType (hFile=0x228) returned 0x1 [0096.001] WriteFile (in: hFile=0x228, lpBuffer=0x226b928*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x226b928*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0096.002] CloseHandle (hObject=0x228) returned 1 [0096.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0096.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40 [0096.002] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.023] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x3f [0096.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x40 [0096.023] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.023] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.024] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0096.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.025] GetFileType (hFile=0x228) returned 0x1 [0096.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.025] GetFileType (hFile=0x228) returned 0x1 [0096.025] WriteFile (in: hFile=0x228, lpBuffer=0x2277bf0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2277bf0*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.026] CloseHandle (hObject=0x228) returned 1 [0096.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.png", lpFilePart=0x0) returned 0x48 [0096.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0096.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.033] GetFileType (hFile=0x228) returned 0x1 [0096.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0096.033] GetFileType (hFile=0x228) returned 0x1 [0096.033] WriteFile (in: hFile=0x228, lpBuffer=0x2278cb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2278cb8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0096.034] CloseHandle (hObject=0x228) returned 1 [0096.034] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0096.034] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.035] GetFileType (hFile=0x228) returned 0x1 [0096.035] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.035] GetFileType (hFile=0x228) returned 0x1 [0096.035] WriteFile (in: hFile=0x228, lpBuffer=0x227c888*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x227c888*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0096.045] CloseHandle (hObject=0x228) returned 1 [0096.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0096.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Publisher\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\publisher\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.078] GetFileType (hFile=0x228) returned 0x1 [0096.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.078] GetFileType (hFile=0x228) returned 0x1 [0096.078] WriteFile (in: hFile=0x228, lpBuffer=0x227f2b8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x227f2b8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0096.079] CloseHandle (hObject=0x228) returned 1 [0096.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0096.079] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a [0096.080] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.080] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.080] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.080] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig", lpFilePart=0x0) returned 0x49 [0096.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\", lpFilePart=0x0) returned 0x4a [0096.081] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.081] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.081] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.081] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.081] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0096.081] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.082] GetFileType (hFile=0x228) returned 0x1 [0096.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.082] GetFileType (hFile=0x228) returned 0x1 [0096.083] WriteFile (in: hFile=0x228, lpBuffer=0x228b780*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x228b780*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.083] CloseHandle (hObject=0x228) returned 1 [0096.084] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.png", lpFilePart=0x0) returned 0x52 [0096.084] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0096.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.084] GetFileType (hFile=0x228) returned 0x1 [0096.084] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0096.084] GetFileType (hFile=0x228) returned 0x1 [0096.084] WriteFile (in: hFile=0x228, lpBuffer=0x228c858*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x228c858*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0096.085] CloseHandle (hObject=0x228) returned 1 [0096.085] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0096.086] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.086] GetFileType (hFile=0x228) returned 0x1 [0096.086] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.086] GetFileType (hFile=0x228) returned 0x1 [0096.086] WriteFile (in: hFile=0x228, lpBuffer=0x2290458*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2290458*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0096.087] CloseHandle (hObject=0x228) returned 1 [0096.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0096.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\TaskSchedulerConfig\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\taskschedulerconfig\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.102] GetFileType (hFile=0x228) returned 0x1 [0096.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.102] GetFileType (hFile=0x228) returned 0x1 [0096.102] WriteFile (in: hFile=0x228, lpBuffer=0x2292ea8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2292ea8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0096.103] CloseHandle (hObject=0x228) returned 1 [0096.103] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0096.103] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c [0096.103] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.104] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.104] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.104] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.104] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.104] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio", lpFilePart=0x0) returned 0x3b [0096.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\", lpFilePart=0x0) returned 0x3c [0096.105] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.105] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.105] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.105] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.105] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.105] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.105] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0096.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.107] GetFileType (hFile=0x228) returned 0x1 [0096.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.107] GetFileType (hFile=0x228) returned 0x1 [0096.107] WriteFile (in: hFile=0x228, lpBuffer=0x229f8f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x229f8f8*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.108] CloseHandle (hObject=0x228) returned 1 [0096.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.png", lpFilePart=0x0) returned 0x44 [0096.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0096.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.109] GetFileType (hFile=0x228) returned 0x1 [0096.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0096.110] GetFileType (hFile=0x228) returned 0x1 [0096.110] WriteFile (in: hFile=0x228, lpBuffer=0x22a09b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22a09b8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0096.111] CloseHandle (hObject=0x228) returned 1 [0096.111] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0096.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0096.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0096.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0096.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.TXT", lpFilePart=0x0) returned 0x3e [0096.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0096.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0096.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x3e [0096.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0096.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0096.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.vbs", lpFilePart=0x0) returned 0x3e [0096.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0096.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0096.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6a [0096.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0096.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0096.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0096.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0096.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b [0096.122] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0096.122] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0096.123] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0096.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0096.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0096.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help", lpFilePart=0x0) returned 0x3a [0096.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\", lpFilePart=0x0) returned 0x3b [0096.123] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0096.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.123] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0096.123] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0096.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0096.123] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.TXT", lpFilePart=0x0) returned 0x43 [0096.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0096.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0096.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.png", lpFilePart=0x0) returned 0x43 [0096.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0096.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0096.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.vbs", lpFilePart=0x0) returned 0x43 [0096.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0096.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0096.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6f [0096.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0096.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft help\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0096.132] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0096.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0096.132] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34 [0096.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0096.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.133] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0096.133] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0096.133] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0096.133] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0096.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla", lpFilePart=0x0) returned 0x33 [0096.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\", lpFilePart=0x0) returned 0x34 [0096.134] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0096.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0096.134] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0096.134] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0096.134] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0096.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0096.135] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c [0096.135] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.136] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.136] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0096.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3b [0096.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3c [0096.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0096.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0096.137] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0096.137] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0096.137] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0096.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0096.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0096.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45 [0096.137] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0096.138] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0096.138] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0096.138] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0096.138] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0096.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0096.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0096.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x44 [0096.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x45 [0096.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0096.138] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0096.139] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0096.139] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0096.139] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0096.139] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0096.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0096.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55 [0096.139] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x56 [0096.139] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0096.155] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0096.156] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0096.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0096.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x55 [0096.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x56 [0096.157] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0096.158] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.158] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.158] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.158] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.158] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.158] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.159] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0096.159] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0096.159] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0096.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0096.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", lpFilePart=0x0) returned 0x5b [0096.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpFilePart=0x0) returned 0x5c [0096.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.164] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.165] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.165] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache", lpFilePart=0x0) returned 0x5b [0096.166] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\", lpFilePart=0x0) returned 0x5c [0096.166] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.168] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", lpFilePart=0x0) returned 0x5d [0096.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpFilePart=0x0) returned 0x5e [0096.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.170] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.170] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.170] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.170] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.170] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0", lpFilePart=0x0) returned 0x5d [0096.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\", lpFilePart=0x0) returned 0x5e [0096.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.171] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", lpFilePart=0x0) returned 0x60 [0096.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpFilePart=0x0) returned 0x61 [0096.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98", lpFilePart=0x0) returned 0x60 [0096.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\", lpFilePart=0x0) returned 0x61 [0096.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.174] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", lpFilePart=0x0) returned 0x60 [0096.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpFilePart=0x0) returned 0x61 [0096.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.181] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8", lpFilePart=0x0) returned 0x60 [0096.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\", lpFilePart=0x0) returned 0x61 [0096.181] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.181] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.181] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", lpFilePart=0x0) returned 0x5d [0096.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpFilePart=0x0) returned 0x5e [0096.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.196] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.196] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1", lpFilePart=0x0) returned 0x5d [0096.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\", lpFilePart=0x0) returned 0x5e [0096.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.197] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", lpFilePart=0x0) returned 0x60 [0096.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpFilePart=0x0) returned 0x61 [0096.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.197] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B", lpFilePart=0x0) returned 0x60 [0096.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\", lpFilePart=0x0) returned 0x61 [0096.198] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.198] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.198] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", lpFilePart=0x0) returned 0x60 [0096.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpFilePart=0x0) returned 0x61 [0096.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2", lpFilePart=0x0) returned 0x60 [0096.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\", lpFilePart=0x0) returned 0x61 [0096.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.207] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.207] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", lpFilePart=0x0) returned 0x60 [0096.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpFilePart=0x0) returned 0x61 [0096.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.214] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.214] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6", lpFilePart=0x0) returned 0x60 [0096.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\", lpFilePart=0x0) returned 0x61 [0096.214] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.215] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.215] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", lpFilePart=0x0) returned 0x5d [0096.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", lpFilePart=0x0) returned 0x5e [0096.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.229] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.229] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.229] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2", lpFilePart=0x0) returned 0x5d [0096.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\", lpFilePart=0x0) returned 0x5e [0096.230] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.230] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.230] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.230] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.234] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\2\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", lpFilePart=0x0) returned 0x5d [0096.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", lpFilePart=0x0) returned 0x5e [0096.235] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.235] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.236] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3", lpFilePart=0x0) returned 0x5d [0096.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\", lpFilePart=0x0) returned 0x5e [0096.236] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.236] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.236] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", lpFilePart=0x0) returned 0x60 [0096.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpFilePart=0x0) returned 0x61 [0096.236] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.237] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B", lpFilePart=0x0) returned 0x60 [0096.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\", lpFilePart=0x0) returned 0x61 [0096.237] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.237] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.238] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", lpFilePart=0x0) returned 0x5d [0096.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", lpFilePart=0x0) returned 0x5e [0096.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.250] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4", lpFilePart=0x0) returned 0x5d [0096.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\", lpFilePart=0x0) returned 0x5e [0096.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.250] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\4\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\4\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", lpFilePart=0x0) returned 0x5d [0096.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", lpFilePart=0x0) returned 0x5e [0096.256] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.257] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.257] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.257] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5", lpFilePart=0x0) returned 0x5d [0096.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\", lpFilePart=0x0) returned 0x5e [0096.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.257] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.257] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.257] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\5\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\5\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", lpFilePart=0x0) returned 0x5d [0096.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", lpFilePart=0x0) returned 0x5e [0096.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.262] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.262] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.262] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6", lpFilePart=0x0) returned 0x5d [0096.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\", lpFilePart=0x0) returned 0x5e [0096.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.263] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.263] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.263] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\6\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", lpFilePart=0x0) returned 0x5d [0096.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", lpFilePart=0x0) returned 0x5e [0096.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.268] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7", lpFilePart=0x0) returned 0x5d [0096.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\", lpFilePart=0x0) returned 0x5e [0096.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.268] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.268] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\7\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\7\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", lpFilePart=0x0) returned 0x5d [0096.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", lpFilePart=0x0) returned 0x5e [0096.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.273] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.273] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8", lpFilePart=0x0) returned 0x5d [0096.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\", lpFilePart=0x0) returned 0x5e [0096.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.274] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\8\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\8\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", lpFilePart=0x0) returned 0x5d [0096.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpFilePart=0x0) returned 0x5e [0096.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.279] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9", lpFilePart=0x0) returned 0x5d [0096.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\", lpFilePart=0x0) returned 0x5e [0096.279] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.280] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", lpFilePart=0x0) returned 0x60 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpFilePart=0x0) returned 0x61 [0096.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.280] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10", lpFilePart=0x0) returned 0x60 [0096.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\", lpFilePart=0x0) returned 0x61 [0096.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.280] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.281] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", lpFilePart=0x0) returned 0x60 [0096.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpFilePart=0x0) returned 0x61 [0096.296] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.297] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C", lpFilePart=0x0) returned 0x60 [0096.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\", lpFilePart=0x0) returned 0x61 [0096.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.297] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.297] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.302] WriteFile (in: hFile=0x228, lpBuffer=0x223af08*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x223af08*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0096.303] CloseHandle (hObject=0x228) returned 1 [0096.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.306] GetFileType (hFile=0x228) returned 0x1 [0096.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.306] GetFileType (hFile=0x228) returned 0x1 [0096.306] WriteFile (in: hFile=0x228, lpBuffer=0x223d9b8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x223d9b8*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0096.306] CloseHandle (hObject=0x228) returned 1 [0096.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", lpFilePart=0x0) returned 0x60 [0096.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpFilePart=0x0) returned 0x61 [0096.307] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.307] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61", lpFilePart=0x0) returned 0x60 [0096.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\", lpFilePart=0x0) returned 0x61 [0096.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.308] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.310] GetFileType (hFile=0x228) returned 0x1 [0096.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.311] GetFileType (hFile=0x228) returned 0x1 [0096.311] WriteFile (in: hFile=0x228, lpBuffer=0x224a890*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x224a890*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0096.312] CloseHandle (hObject=0x228) returned 1 [0096.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.312] GetFileType (hFile=0x228) returned 0x1 [0096.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.312] GetFileType (hFile=0x228) returned 0x1 [0096.312] WriteFile (in: hFile=0x228, lpBuffer=0x224b998*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x224b998*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0096.313] CloseHandle (hObject=0x228) returned 1 [0096.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.314] GetFileType (hFile=0x228) returned 0x1 [0096.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.314] GetFileType (hFile=0x228) returned 0x1 [0096.314] WriteFile (in: hFile=0x228, lpBuffer=0x224f628*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x224f628*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0096.315] CloseHandle (hObject=0x228) returned 1 [0096.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.318] GetFileType (hFile=0x228) returned 0x1 [0096.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.318] GetFileType (hFile=0x228) returned 0x1 [0096.318] WriteFile (in: hFile=0x228, lpBuffer=0x22520d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x22520d8*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0096.318] CloseHandle (hObject=0x228) returned 1 [0096.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", lpFilePart=0x0) returned 0x60 [0096.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpFilePart=0x0) returned 0x61 [0096.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.320] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0", lpFilePart=0x0) returned 0x60 [0096.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\", lpFilePart=0x0) returned 0x61 [0096.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.321] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0096.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.323] GetFileType (hFile=0x228) returned 0x1 [0096.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.323] GetFileType (hFile=0x228) returned 0x1 [0096.324] WriteFile (in: hFile=0x228, lpBuffer=0x225efb0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x225efb0*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0096.325] CloseHandle (hObject=0x228) returned 1 [0096.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.png", lpFilePart=0x0) returned 0x69 [0096.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.325] GetFileType (hFile=0x228) returned 0x1 [0096.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.325] GetFileType (hFile=0x228) returned 0x1 [0096.325] WriteFile (in: hFile=0x228, lpBuffer=0x22600b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22600b8*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0096.326] CloseHandle (hObject=0x228) returned 1 [0096.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0096.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.327] GetFileType (hFile=0x228) returned 0x1 [0096.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.327] GetFileType (hFile=0x228) returned 0x1 [0096.327] WriteFile (in: hFile=0x228, lpBuffer=0x2263d48*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x2263d48*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0096.328] CloseHandle (hObject=0x228) returned 1 [0096.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0096.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.333] GetFileType (hFile=0x228) returned 0x1 [0096.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.333] GetFileType (hFile=0x228) returned 0x1 [0096.333] WriteFile (in: hFile=0x228, lpBuffer=0x22667f8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x22667f8*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0096.334] CloseHandle (hObject=0x228) returned 1 [0096.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.335] GetFileType (hFile=0x228) returned 0x1 [0096.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.335] GetFileType (hFile=0x228) returned 0x1 [0096.335] WriteFile (in: hFile=0x228, lpBuffer=0x2270b80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2270b80*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.336] CloseHandle (hObject=0x228) returned 1 [0096.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.336] GetFileType (hFile=0x228) returned 0x1 [0096.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.337] GetFileType (hFile=0x228) returned 0x1 [0096.337] WriteFile (in: hFile=0x228, lpBuffer=0x2271c80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x2271c80*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0096.337] CloseHandle (hObject=0x228) returned 1 [0096.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.338] GetFileType (hFile=0x228) returned 0x1 [0096.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.338] GetFileType (hFile=0x228) returned 0x1 [0096.338] WriteFile (in: hFile=0x228, lpBuffer=0x22758f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x22758f8*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0096.339] CloseHandle (hObject=0x228) returned 1 [0096.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0096.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.341] GetFileType (hFile=0x228) returned 0x1 [0096.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.342] GetFileType (hFile=0x228) returned 0x1 [0096.342] WriteFile (in: hFile=0x228, lpBuffer=0x2278398*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2278398*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0096.342] CloseHandle (hObject=0x228) returned 1 [0096.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", lpFilePart=0x0) returned 0x5d [0096.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", lpFilePart=0x0) returned 0x5e [0096.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.343] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.343] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.343] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A", lpFilePart=0x0) returned 0x5d [0096.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\", lpFilePart=0x0) returned 0x5e [0096.343] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.343] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.344] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.344] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0096.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.345] GetFileType (hFile=0x228) returned 0x1 [0096.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.345] GetFileType (hFile=0x228) returned 0x1 [0096.345] WriteFile (in: hFile=0x228, lpBuffer=0x2284cc0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2284cc0*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.346] CloseHandle (hObject=0x228) returned 1 [0096.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.png", lpFilePart=0x0) returned 0x66 [0096.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.346] GetFileType (hFile=0x228) returned 0x1 [0096.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.346] GetFileType (hFile=0x228) returned 0x1 [0096.346] WriteFile (in: hFile=0x228, lpBuffer=0x2285dc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x2285dc0*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0096.347] CloseHandle (hObject=0x228) returned 1 [0096.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0096.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.348] GetFileType (hFile=0x228) returned 0x1 [0096.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.348] GetFileType (hFile=0x228) returned 0x1 [0096.348] WriteFile (in: hFile=0x228, lpBuffer=0x2289a38*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x2289a38*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0096.349] CloseHandle (hObject=0x228) returned 1 [0096.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\A\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\a\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.349] GetFileType (hFile=0x228) returned 0x1 [0096.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.349] GetFileType (hFile=0x228) returned 0x1 [0096.349] WriteFile (in: hFile=0x228, lpBuffer=0x228c4d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x228c4d8*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0096.350] CloseHandle (hObject=0x228) returned 1 [0096.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.350] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.351] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.351] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.352] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.352] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.352] GetFileType (hFile=0x228) returned 0x1 [0096.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.353] GetFileType (hFile=0x228) returned 0x1 [0096.353] WriteFile (in: hFile=0x228, lpBuffer=0x2298e00*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2298e00*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.354] CloseHandle (hObject=0x228) returned 1 [0096.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.354] GetFileType (hFile=0x228) returned 0x1 [0096.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.354] GetFileType (hFile=0x228) returned 0x1 [0096.354] WriteFile (in: hFile=0x228, lpBuffer=0x2299f00*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x2299f00*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0096.355] CloseHandle (hObject=0x228) returned 1 [0096.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.356] GetFileType (hFile=0x228) returned 0x1 [0096.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.356] GetFileType (hFile=0x228) returned 0x1 [0096.356] WriteFile (in: hFile=0x228, lpBuffer=0x229db78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x229db78*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0096.356] CloseHandle (hObject=0x228) returned 1 [0096.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\b\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.357] GetFileType (hFile=0x228) returned 0x1 [0096.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.357] GetFileType (hFile=0x228) returned 0x1 [0096.357] WriteFile (in: hFile=0x228, lpBuffer=0x22a0618*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22a0618*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0096.358] CloseHandle (hObject=0x228) returned 1 [0096.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.358] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.358] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.358] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.359] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.359] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.360] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.360] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.360] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.361] GetFileType (hFile=0x228) returned 0x1 [0096.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.361] GetFileType (hFile=0x228) returned 0x1 [0096.361] WriteFile (in: hFile=0x228, lpBuffer=0x22aff10*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x22aff10*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0096.362] CloseHandle (hObject=0x228) returned 1 [0096.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.363] GetFileType (hFile=0x228) returned 0x1 [0096.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.363] GetFileType (hFile=0x228) returned 0x1 [0096.363] WriteFile (in: hFile=0x228, lpBuffer=0x22b1018*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22b1018*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0096.364] CloseHandle (hObject=0x228) returned 1 [0096.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.364] GetFileType (hFile=0x228) returned 0x1 [0096.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.364] GetFileType (hFile=0x228) returned 0x1 [0096.364] WriteFile (in: hFile=0x228, lpBuffer=0x22b4ca8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x22b4ca8*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0096.365] CloseHandle (hObject=0x228) returned 1 [0096.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.368] GetFileType (hFile=0x228) returned 0x1 [0096.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.368] GetFileType (hFile=0x228) returned 0x1 [0096.368] WriteFile (in: hFile=0x228, lpBuffer=0x22b7758*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x22b7758*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0096.369] CloseHandle (hObject=0x228) returned 1 [0096.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.370] GetFileType (hFile=0x228) returned 0x1 [0096.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.370] GetFileType (hFile=0x228) returned 0x1 [0096.370] WriteFile (in: hFile=0x228, lpBuffer=0x22c1ae0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x22c1ae0*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0096.371] CloseHandle (hObject=0x228) returned 1 [0096.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.372] GetFileType (hFile=0x228) returned 0x1 [0096.372] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.372] GetFileType (hFile=0x228) returned 0x1 [0096.372] WriteFile (in: hFile=0x228, lpBuffer=0x22c2be0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x22c2be0*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0096.373] CloseHandle (hObject=0x228) returned 1 [0096.373] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.373] GetFileType (hFile=0x228) returned 0x1 [0096.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.373] GetFileType (hFile=0x228) returned 0x1 [0096.373] WriteFile (in: hFile=0x228, lpBuffer=0x22c6858*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x22c6858*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0096.374] CloseHandle (hObject=0x228) returned 1 [0096.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.377] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.377] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.378] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.378] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.378] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.378] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.378] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.379] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.379] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.380] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.380] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.387] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.393] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.393] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.394] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.394] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.394] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.394] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.394] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.395] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.395] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.395] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.395] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.395] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.395] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.395] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.395] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.396] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.396] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.396] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.396] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.396] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.396] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.405] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.412] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.414] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0096.414] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0096.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0096.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0096.414] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0096.414] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0096.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.415] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.415] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.416] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.418] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.422] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.424] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf840 [0096.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0096.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0096.424] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0096.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0096.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.424] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0096.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0096.427] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.428] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.428] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0096.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.430] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0096.430] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.431] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.432] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0096.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.432] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0096.433] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0096.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.445] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0096.446] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0096.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.450] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.452] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.453] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.453] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.454] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.455] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0096.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.461] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.462] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.474] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.475] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.475] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.476] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.477] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.477] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0096.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\safebrowsing\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\safebrowsing\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.485] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.485] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0096.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0096.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0096.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\startupCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\startupcache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0096.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0096.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.491] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.496] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.497] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.497] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0096.497] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0096.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0096.498] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0096.498] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0096.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0096.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0096.499] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", dwFileAttributes=0x80) returned 1 [0096.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0096.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0096.932] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0096.933] ReadFile (in: hFile=0x15c, lpBuffer=0x2296a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2296a60*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0096.935] ReadFile (in: hFile=0x15c, lpBuffer=0x2296a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2296a60*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0096.935] ReadFile (in: hFile=0x15c, lpBuffer=0x2296a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2296a60*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0096.936] ReadFile (in: hFile=0x15c, lpBuffer=0x2296a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2296a60*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0096.936] ReadFile (in: hFile=0x15c, lpBuffer=0x2296a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2296a60*, lpNumberOfBytesRead=0x2edc68*=0xb0, lpOverlapped=0x0) returned 1 [0096.936] ReadFile (in: hFile=0x15c, lpBuffer=0x2296a60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2296a60*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0096.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png", lpFilePart=0x0) returned 0x85 [0096.936] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\4cc87c1409819bf06f42b782d4902b2f.png")) returned 1 [0096.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFilePart=0x0) returned 0x85 [0096.937] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", dwFileAttributes=0x80) returned 1 [0096.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.Horsuke", lpFilePart=0x0) returned 0x8d [0096.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFilePart=0x0) returned 0x85 [0097.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0097.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0097.416] GetFileType (hFile=0x15c) returned 0x1 [0097.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0097.416] GetFileType (hFile=0x15c) returned 0x1 [0097.416] ReadFile (in: hFile=0x15c, lpBuffer=0x2383860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2383860*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.436] ReadFile (in: hFile=0x15c, lpBuffer=0x2383860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2383860*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.436] ReadFile (in: hFile=0x15c, lpBuffer=0x2383860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2383860*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.436] ReadFile (in: hFile=0x15c, lpBuffer=0x2383860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2383860*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.436] ReadFile (in: hFile=0x15c, lpBuffer=0x2383860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2383860*, lpNumberOfBytesRead=0x2edc68*=0xb0, lpOverlapped=0x0) returned 1 [0097.437] ReadFile (in: hFile=0x15c, lpBuffer=0x2383860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2383860*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0097.437] CloseHandle (hObject=0x15c) returned 1 [0097.437] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png", lpFilePart=0x0) returned 0x85 [0097.437] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ba182bcd131f1f3c6b6fbbb1ba078341.png")) returned 1 [0097.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFilePart=0x0) returned 0x85 [0097.438] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", dwFileAttributes=0x80) returned 1 [0097.439] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.Horsuke", lpFilePart=0x0) returned 0x8d [0097.439] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0097.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.440] GetFileType (hFile=0x228) returned 0x1 [0097.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0097.440] GetFileType (hFile=0x228) returned 0x1 [0097.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFilePart=0x0) returned 0x85 [0097.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0097.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0097.887] GetFileType (hFile=0x15c) returned 0x1 [0097.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0097.887] GetFileType (hFile=0x15c) returned 0x1 [0097.887] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.905] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.906] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.907] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.907] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.907] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.907] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.908] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.909] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.910] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.910] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.910] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.910] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.910] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.911] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x1000, lpOverlapped=0x0) returned 1 [0097.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x362, lpOverlapped=0x0) returned 1 [0097.912] ReadFile (in: hFile=0x15c, lpBuffer=0x2270708, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2270708*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0097.912] CloseHandle (hObject=0x15c) returned 1 [0097.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png", lpFilePart=0x0) returned 0x85 [0097.912] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\ce8c0453589216a67cddb50284fbfe8d.png")) returned 1 [0097.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.TXT", lpFilePart=0x0) returned 0x69 [0097.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0097.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.917] GetFileType (hFile=0x228) returned 0x1 [0097.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0097.917] GetFileType (hFile=0x228) returned 0x1 [0097.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.png", lpFilePart=0x0) returned 0x69 [0097.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0097.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.918] GetFileType (hFile=0x228) returned 0x1 [0097.918] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0097.918] GetFileType (hFile=0x228) returned 0x1 [0097.918] WriteFile (in: hFile=0x228, lpBuffer=0x2298b40*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x2298b40*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0097.919] CloseHandle (hObject=0x228) returned 1 [0097.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.vbs", lpFilePart=0x0) returned 0x69 [0097.919] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0097.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.920] GetFileType (hFile=0x228) returned 0x1 [0097.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0097.920] GetFileType (hFile=0x228) returned 0x1 [0097.920] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x95 [0097.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0097.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\thumbnails\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\thumbnails\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.921] GetFileType (hFile=0x228) returned 0x1 [0097.921] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0097.921] GetFileType (hFile=0x228) returned 0x1 [0097.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.TXT", lpFilePart=0x0) returned 0x5e [0097.922] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0097.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.922] GetFileType (hFile=0x228) returned 0x1 [0097.922] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0097.922] GetFileType (hFile=0x228) returned 0x1 [0097.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.png", lpFilePart=0x0) returned 0x5e [0097.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0097.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.923] GetFileType (hFile=0x228) returned 0x1 [0097.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0097.923] GetFileType (hFile=0x228) returned 0x1 [0097.924] WriteFile (in: hFile=0x228, lpBuffer=0x22aa6d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22aa6d8*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0097.924] CloseHandle (hObject=0x228) returned 1 [0097.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.vbs", lpFilePart=0x0) returned 0x5e [0097.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0097.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.925] GetFileType (hFile=0x228) returned 0x1 [0097.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0097.925] GetFileType (hFile=0x228) returned 0x1 [0097.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8a [0097.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0097.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.926] GetFileType (hFile=0x228) returned 0x1 [0097.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0097.926] GetFileType (hFile=0x228) returned 0x1 [0097.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.TXT", lpFilePart=0x0) returned 0x4d [0097.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0097.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.927] GetFileType (hFile=0x228) returned 0x1 [0097.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0097.927] GetFileType (hFile=0x228) returned 0x1 [0097.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.png", lpFilePart=0x0) returned 0x4d [0097.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0097.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.928] GetFileType (hFile=0x228) returned 0x1 [0097.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0097.928] GetFileType (hFile=0x228) returned 0x1 [0097.929] WriteFile (in: hFile=0x228, lpBuffer=0x22bc198*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22bc198*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0097.929] CloseHandle (hObject=0x228) returned 1 [0097.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.vbs", lpFilePart=0x0) returned 0x4d [0097.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0097.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.930] GetFileType (hFile=0x228) returned 0x1 [0097.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0097.930] GetFileType (hFile=0x228) returned 0x1 [0097.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x79 [0097.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0097.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.932] GetFileType (hFile=0x228) returned 0x1 [0097.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0097.932] GetFileType (hFile=0x228) returned 0x1 [0097.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0097.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0097.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.934] GetFileType (hFile=0x228) returned 0x1 [0097.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0097.934] GetFileType (hFile=0x228) returned 0x1 [0097.934] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.png", lpFilePart=0x0) returned 0x44 [0097.934] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0097.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.935] GetFileType (hFile=0x228) returned 0x1 [0097.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0097.935] GetFileType (hFile=0x228) returned 0x1 [0097.935] WriteFile (in: hFile=0x228, lpBuffer=0x22cdb88*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22cdb88*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0097.936] CloseHandle (hObject=0x228) returned 1 [0097.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0097.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0097.936] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.937] GetFileType (hFile=0x228) returned 0x1 [0097.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0097.937] GetFileType (hFile=0x228) returned 0x1 [0097.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0097.937] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0097.937] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0097.939] GetFileType (hFile=0x228) returned 0x1 [0097.939] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0097.939] GetFileType (hFile=0x228) returned 0x1 [0097.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0097.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b [0097.940] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x3c [0097.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0097.941] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0097.941] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0097.941] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0097.941] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0097.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0097.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0097.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0097.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates", lpFilePart=0x0) returned 0x3b [0097.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\", lpFilePart=0x0) returned 0x3c [0097.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0097.941] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0097.941] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0097.942] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0097.942] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0097.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0097.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0097.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0097.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c [0097.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpFilePart=0x0) returned 0x4d [0097.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0097.953] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.954] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0097.954] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0097.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0097.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0097.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0097.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B", lpFilePart=0x0) returned 0x4c [0097.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\", lpFilePart=0x0) returned 0x4d [0097.955] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0097.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0097.956] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0097.956] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0097.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0097.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0097.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFilePart=0x0) returned 0x5e [0097.957] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", dwFileAttributes=0x80) returned 1 [0097.959] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.Horsuke", lpFilePart=0x0) returned 0x66 [0097.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0097.959] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0097.959] GetFileType (hFile=0x228) returned 0x1 [0097.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0097.959] GetFileType (hFile=0x228) returned 0x1 [0098.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFilePart=0x0) returned 0x5e [0098.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0098.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0098.533] GetFileType (hFile=0x15c) returned 0x1 [0098.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0098.533] GetFileType (hFile=0x15c) returned 0x1 [0098.533] ReadFile (in: hFile=0x15c, lpBuffer=0x23c20b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23c20b8*, lpNumberOfBytesRead=0x2edd68*=0x464, lpOverlapped=0x0) returned 1 [0098.550] ReadFile (in: hFile=0x15c, lpBuffer=0x23c1d04, nNumberOfBytesToRead=0x39c, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23c1d04*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0098.550] ReadFile (in: hFile=0x15c, lpBuffer=0x23c20b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23c20b8*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0098.550] CloseHandle (hObject=0x15c) returned 1 [0098.550] WriteFile (in: hFile=0x228, lpBuffer=0x23c0580*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x23c0580*, lpNumberOfBytesWritten=0x2edc38*=0x490, lpOverlapped=0x0) returned 1 [0098.551] CloseHandle (hObject=0x228) returned 1 [0098.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml", lpFilePart=0x0) returned 0x5e [0098.551] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\active-update.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\active-update.xml")) returned 1 [0098.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFilePart=0x0) returned 0x58 [0098.552] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", dwFileAttributes=0x80) returned 1 [0098.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.Horsuke", lpFilePart=0x0) returned 0x60 [0098.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0098.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0098.554] GetFileType (hFile=0x228) returned 0x1 [0098.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0098.554] GetFileType (hFile=0x228) returned 0x1 [0099.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFilePart=0x0) returned 0x58 [0099.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0099.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0099.002] GetFileType (hFile=0x15c) returned 0x1 [0099.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0099.002] GetFileType (hFile=0x15c) returned 0x1 [0099.002] ReadFile (in: hFile=0x15c, lpBuffer=0x22aa5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22aa5b0*, lpNumberOfBytesRead=0x2edd68*=0x39, lpOverlapped=0x0) returned 1 [0099.003] ReadFile (in: hFile=0x15c, lpBuffer=0x22aa5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22aa5b0*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0099.003] CloseHandle (hObject=0x15c) returned 1 [0099.003] WriteFile (in: hFile=0x228, lpBuffer=0x22a8a90*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x22a8a90*, lpNumberOfBytesWritten=0x2edc38*=0x60, lpOverlapped=0x0) returned 1 [0099.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml", lpFilePart=0x0) returned 0x58 [0099.004] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates.xml")) returned 1 [0099.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0099.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0099.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55 [0099.005] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0099.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0099.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0099.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0099.006] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0099.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0099.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0099.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0099.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates", lpFilePart=0x0) returned 0x54 [0099.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\", lpFilePart=0x0) returned 0x55 [0099.006] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0099.006] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0099.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0099.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0099.007] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0099.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0099.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0099.007] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0099.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", lpFilePart=0x0) returned 0x56 [0099.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpFilePart=0x0) returned 0x57 [0099.007] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0099.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0099.007] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0099.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0099.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0099.008] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0099.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0099.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0099.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0099.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0", lpFilePart=0x0) returned 0x56 [0099.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\", lpFilePart=0x0) returned 0x57 [0099.008] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0099.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0099.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0099.008] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0099.009] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0099.009] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0099.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0099.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0099.011] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.TXT", lpFilePart=0x0) returned 0x5f [0099.011] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0099.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.012] GetFileType (hFile=0x228) returned 0x1 [0099.012] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0099.012] GetFileType (hFile=0x228) returned 0x1 [0099.012] WriteFile (in: hFile=0x228, lpBuffer=0x22ba178*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x22ba178*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0099.013] CloseHandle (hObject=0x228) returned 1 [0099.013] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.png", lpFilePart=0x0) returned 0x5f [0099.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0099.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.014] GetFileType (hFile=0x228) returned 0x1 [0099.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0099.014] GetFileType (hFile=0x228) returned 0x1 [0099.014] WriteFile (in: hFile=0x228, lpBuffer=0x22bb268*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22bb268*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0099.015] CloseHandle (hObject=0x228) returned 1 [0099.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.vbs", lpFilePart=0x0) returned 0x5f [0099.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0099.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.016] GetFileType (hFile=0x228) returned 0x1 [0099.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0099.016] GetFileType (hFile=0x228) returned 0x1 [0099.016] WriteFile (in: hFile=0x228, lpBuffer=0x22beeb0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x22beeb0*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0099.017] CloseHandle (hObject=0x228) returned 1 [0099.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8b [0099.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0099.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.019] GetFileType (hFile=0x228) returned 0x1 [0099.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0099.019] GetFileType (hFile=0x228) returned 0x1 [0099.019] WriteFile (in: hFile=0x228, lpBuffer=0x22c1930*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x22c1930*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0099.020] CloseHandle (hObject=0x228) returned 1 [0099.021] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0099.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0099.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.022] GetFileType (hFile=0x228) returned 0x1 [0099.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0099.022] GetFileType (hFile=0x228) returned 0x1 [0099.022] WriteFile (in: hFile=0x228, lpBuffer=0x22cbc98*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22cbc98*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0099.023] CloseHandle (hObject=0x228) returned 1 [0099.023] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.png", lpFilePart=0x0) returned 0x5d [0099.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0099.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.024] GetFileType (hFile=0x228) returned 0x1 [0099.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0099.024] GetFileType (hFile=0x228) returned 0x1 [0099.024] WriteFile (in: hFile=0x228, lpBuffer=0x22ccd88*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22ccd88*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0099.025] CloseHandle (hObject=0x228) returned 1 [0099.025] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0099.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0099.025] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.025] GetFileType (hFile=0x228) returned 0x1 [0099.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0099.025] GetFileType (hFile=0x228) returned 0x1 [0099.025] WriteFile (in: hFile=0x228, lpBuffer=0x22d09d0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x22d09d0*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0099.026] CloseHandle (hObject=0x228) returned 1 [0099.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0099.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0099.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\updates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\updates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.041] GetFileType (hFile=0x228) returned 0x1 [0099.041] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0099.041] GetFileType (hFile=0x228) returned 0x1 [0099.041] WriteFile (in: hFile=0x228, lpBuffer=0x22d3450*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22d3450*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0099.042] CloseHandle (hObject=0x228) returned 1 [0099.042] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.TXT", lpFilePart=0x0) returned 0x55 [0099.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0099.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.043] GetFileType (hFile=0x228) returned 0x1 [0099.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0099.043] GetFileType (hFile=0x228) returned 0x1 [0099.043] WriteFile (in: hFile=0x228, lpBuffer=0x22dd798*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22dd798*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0099.044] CloseHandle (hObject=0x228) returned 1 [0099.044] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.png", lpFilePart=0x0) returned 0x55 [0099.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0099.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.045] GetFileType (hFile=0x228) returned 0x1 [0099.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0099.045] GetFileType (hFile=0x228) returned 0x1 [0099.045] WriteFile (in: hFile=0x228, lpBuffer=0x22de878*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22de878*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0099.046] CloseHandle (hObject=0x228) returned 1 [0099.046] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.vbs", lpFilePart=0x0) returned 0x55 [0099.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0099.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.046] GetFileType (hFile=0x228) returned 0x1 [0099.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0099.046] GetFileType (hFile=0x228) returned 0x1 [0099.046] WriteFile (in: hFile=0x228, lpBuffer=0x22e2490*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x22e2490*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0099.047] CloseHandle (hObject=0x228) returned 1 [0099.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x81 [0099.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0099.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\E7CF176E110C211B\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\e7cf176e110c211b\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.047] GetFileType (hFile=0x228) returned 0x1 [0099.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0099.048] GetFileType (hFile=0x228) returned 0x1 [0099.048] WriteFile (in: hFile=0x228, lpBuffer=0x22e4ef0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22e4ef0*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0099.048] CloseHandle (hObject=0x228) returned 1 [0099.048] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0099.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0099.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.049] GetFileType (hFile=0x228) returned 0x1 [0099.049] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0099.049] GetFileType (hFile=0x228) returned 0x1 [0099.049] WriteFile (in: hFile=0x228, lpBuffer=0x22ef1f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22ef1f8*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0099.050] CloseHandle (hObject=0x228) returned 1 [0099.050] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.png", lpFilePart=0x0) returned 0x44 [0099.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0099.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.050] GetFileType (hFile=0x228) returned 0x1 [0099.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0099.050] GetFileType (hFile=0x228) returned 0x1 [0099.050] WriteFile (in: hFile=0x228, lpBuffer=0x22f02b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22f02b8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0099.051] CloseHandle (hObject=0x228) returned 1 [0099.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0099.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0099.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.052] GetFileType (hFile=0x228) returned 0x1 [0099.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0099.052] GetFileType (hFile=0x228) returned 0x1 [0099.052] WriteFile (in: hFile=0x228, lpBuffer=0x22f3e70*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22f3e70*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0099.053] CloseHandle (hObject=0x228) returned 1 [0099.053] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0099.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0099.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\updates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\updates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.055] GetFileType (hFile=0x228) returned 0x1 [0099.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0099.055] GetFileType (hFile=0x228) returned 0x1 [0099.055] WriteFile (in: hFile=0x228, lpBuffer=0x22f6890*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22f6890*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0099.055] CloseHandle (hObject=0x228) returned 1 [0099.056] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0099.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0099.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.056] GetFileType (hFile=0x228) returned 0x1 [0099.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0099.056] GetFileType (hFile=0x228) returned 0x1 [0099.056] WriteFile (in: hFile=0x228, lpBuffer=0x2300b78*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2300b78*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0099.057] CloseHandle (hObject=0x228) returned 1 [0099.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x3c [0099.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0099.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.058] GetFileType (hFile=0x228) returned 0x1 [0099.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0099.058] GetFileType (hFile=0x228) returned 0x1 [0099.058] WriteFile (in: hFile=0x228, lpBuffer=0x2301c28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2301c28*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0099.059] CloseHandle (hObject=0x228) returned 1 [0099.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0099.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0099.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.066] GetFileType (hFile=0x228) returned 0x1 [0099.066] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0099.066] GetFileType (hFile=0x228) returned 0x1 [0099.066] WriteFile (in: hFile=0x228, lpBuffer=0x23057b0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x23057b0*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0099.067] CloseHandle (hObject=0x228) returned 1 [0099.067] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0099.067] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0099.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x228 [0099.068] GetFileType (hFile=0x228) returned 0x1 [0099.068] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0099.069] GetFileType (hFile=0x228) returned 0x1 [0099.069] WriteFile (in: hFile=0x228, lpBuffer=0x23081b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23081b0*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0099.069] CloseHandle (hObject=0x228) returned 1 [0099.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0099.069] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0099.070] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0099.070] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.070] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.071] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.072] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.073] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0099.073] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0099.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0099.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0099.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0099.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp", lpFilePart=0x0) returned 0x30 [0099.073] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x31 [0099.073] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.074] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.075] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.076] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0099.077] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0099.077] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0099.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0099.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0099.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", lpFilePart=0x0) returned 0x49 [0099.077] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", dwFileAttributes=0x80) returned 1 [0099.077] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4.Horsuke", lpFilePart=0x0) returned 0x51 [0099.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0099.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0lkana4cr18bwdr xkuf.mp4.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0099.538] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", lpFilePart=0x0) returned 0x49 [0099.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0099.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0lkana4cr18bwdr xkuf.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0099.539] GetFileType (hFile=0x15c) returned 0x1 [0099.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0099.539] GetFileType (hFile=0x15c) returned 0x1 [0099.540] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.545] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.546] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.546] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.546] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.546] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.547] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0099.547] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x8e0, lpOverlapped=0x0) returned 1 [0099.547] ReadFile (in: hFile=0x15c, lpBuffer=0x23f9d40, nNumberOfBytesToRead=0x320, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23f9d40*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0099.547] ReadFile (in: hFile=0x15c, lpBuffer=0x23fa078, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23fa078*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0099.547] CloseHandle (hObject=0x15c) returned 1 [0099.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4", lpFilePart=0x0) returned 0x49 [0099.547] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\0Lkana4Cr18bwdR XKuF.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\0lkana4cr18bwdr xkuf.mp4")) returned 1 [0099.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", lpFilePart=0x0) returned 0x42 [0099.548] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", dwFileAttributes=0x80) returned 1 [0099.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls.Horsuke", lpFilePart=0x0) returned 0x4a [0099.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0099.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1m5ctrxkb-gaq.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0099.551] GetFileType (hFile=0x228) returned 0x1 [0099.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0099.551] GetFileType (hFile=0x228) returned 0x1 [0100.102] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", lpFilePart=0x0) returned 0x42 [0100.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0100.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1m5ctrxkb-gaq.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0100.103] GetFileType (hFile=0x15c) returned 0x1 [0100.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0100.103] GetFileType (hFile=0x15c) returned 0x1 [0100.103] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.177] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.179] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.179] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.179] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.180] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.180] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.180] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.180] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.181] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.181] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.181] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.181] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.182] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.182] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.182] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.182] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x76f, lpOverlapped=0x0) returned 1 [0100.182] ReadFile (in: hFile=0x15c, lpBuffer=0x22e854f, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e854f*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0100.183] ReadFile (in: hFile=0x15c, lpBuffer=0x22e85f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22e85f8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0100.183] CloseHandle (hObject=0x15c) returned 1 [0100.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls", lpFilePart=0x0) returned 0x42 [0100.183] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\1m5cTrxkB-gaq.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\1m5ctrxkb-gaq.xls")) returned 1 [0100.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", lpFilePart=0x0) returned 0x45 [0100.184] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", dwFileAttributes=0x80) returned 1 [0100.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4.Horsuke", lpFilePart=0x0) returned 0x4d [0100.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0100.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\25aptjpanrp6y42s.mp4.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0100.186] GetFileType (hFile=0x228) returned 0x1 [0100.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0100.186] GetFileType (hFile=0x228) returned 0x1 [0100.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", lpFilePart=0x0) returned 0x45 [0100.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0100.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\25aptjpanrp6y42s.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0100.671] GetFileType (hFile=0x15c) returned 0x1 [0100.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0100.671] GetFileType (hFile=0x15c) returned 0x1 [0100.671] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.676] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.676] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.677] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.677] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.677] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.677] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.678] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.678] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.678] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.678] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0100.679] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x5d3, lpOverlapped=0x0) returned 1 [0100.679] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfb5b, nNumberOfBytesToRead=0x22d, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfb5b*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0100.679] ReadFile (in: hFile=0x15c, lpBuffer=0x23dfda0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23dfda0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0100.679] CloseHandle (hObject=0x15c) returned 1 [0100.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4", lpFilePart=0x0) returned 0x45 [0100.679] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\25aptjpaNRP6y42s.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\25aptjpanrp6y42s.mp4")) returned 1 [0100.680] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", lpFilePart=0x0) returned 0x3c [0100.680] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", dwFileAttributes=0x80) returned 1 [0100.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a.Horsuke", lpFilePart=0x0) returned 0x44 [0100.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0100.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\594xwru.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0100.682] GetFileType (hFile=0x228) returned 0x1 [0100.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0100.682] GetFileType (hFile=0x228) returned 0x1 [0101.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", lpFilePart=0x0) returned 0x3c [0101.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0101.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\594xwru.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0101.205] GetFileType (hFile=0x15c) returned 0x1 [0101.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0101.205] GetFileType (hFile=0x15c) returned 0x1 [0101.205] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.210] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.211] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.211] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.211] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.212] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.212] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x8d5, lpOverlapped=0x0) returned 1 [0101.212] ReadFile (in: hFile=0x15c, lpBuffer=0x22d1db5, nNumberOfBytesToRead=0x32b, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d1db5*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0101.212] ReadFile (in: hFile=0x15c, lpBuffer=0x22d20f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d20f8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0101.212] CloseHandle (hObject=0x15c) returned 1 [0101.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a", lpFilePart=0x0) returned 0x3c [0101.212] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\594XWrU.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\594xwru.m4a")) returned 1 [0101.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", lpFilePart=0x0) returned 0x40 [0101.213] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", dwFileAttributes=0x80) returned 1 [0101.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi.Horsuke", lpFilePart=0x0) returned 0x48 [0101.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0101.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\btan7dt5yws.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0101.215] GetFileType (hFile=0x228) returned 0x1 [0101.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0101.215] GetFileType (hFile=0x228) returned 0x1 [0101.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", lpFilePart=0x0) returned 0x40 [0101.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0101.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\btan7dt5yws.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0101.701] GetFileType (hFile=0x15c) returned 0x1 [0101.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0101.701] GetFileType (hFile=0x15c) returned 0x1 [0101.701] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.706] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.706] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.706] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.707] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.707] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.707] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.707] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.707] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.708] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.708] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.708] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.708] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0101.708] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x1be, lpOverlapped=0x0) returned 1 [0101.709] ReadFile (in: hFile=0x15c, lpBuffer=0x23bf620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bf620*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0101.709] CloseHandle (hObject=0x15c) returned 1 [0101.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi", lpFilePart=0x0) returned 0x40 [0101.709] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\bTan7dt5YWS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\btan7dt5yws.avi")) returned 1 [0101.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", lpFilePart=0x0) returned 0x48 [0101.710] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", dwFileAttributes=0x80) returned 1 [0101.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf.Horsuke", lpFilePart=0x0) returned 0x50 [0101.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0101.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dctdjwghrsmmhjdb-ij.rtf.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0101.712] GetFileType (hFile=0x228) returned 0x1 [0101.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0101.712] GetFileType (hFile=0x228) returned 0x1 [0102.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", lpFilePart=0x0) returned 0x48 [0102.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0102.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dctdjwghrsmmhjdb-ij.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0102.266] GetFileType (hFile=0x15c) returned 0x1 [0102.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0102.266] GetFileType (hFile=0x15c) returned 0x1 [0102.267] ReadFile (in: hFile=0x15c, lpBuffer=0x22b36a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22b36a0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.271] ReadFile (in: hFile=0x15c, lpBuffer=0x22b36a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22b36a0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.272] ReadFile (in: hFile=0x15c, lpBuffer=0x22b36a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22b36a0*, lpNumberOfBytesRead=0x2ede68*=0x6b9, lpOverlapped=0x0) returned 1 [0102.272] ReadFile (in: hFile=0x15c, lpBuffer=0x22b3541, nNumberOfBytesToRead=0x147, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22b3541*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0102.272] ReadFile (in: hFile=0x15c, lpBuffer=0x22b36a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22b36a0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0102.272] CloseHandle (hObject=0x15c) returned 1 [0102.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf", lpFilePart=0x0) returned 0x48 [0102.272] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dCtDJWgHRsmmHjDB-IJ.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dctdjwghrsmmhjdb-ij.rtf")) returned 1 [0102.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", lpFilePart=0x0) returned 0x39 [0102.273] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", dwFileAttributes=0x80) returned 1 [0102.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp.Horsuke", lpFilePart=0x0) returned 0x41 [0102.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0102.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dmix.odp.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0102.275] GetFileType (hFile=0x228) returned 0x1 [0102.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0102.275] GetFileType (hFile=0x228) returned 0x1 [0102.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", lpFilePart=0x0) returned 0x39 [0102.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0102.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dmix.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0102.726] GetFileType (hFile=0x15c) returned 0x1 [0102.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0102.726] GetFileType (hFile=0x15c) returned 0x1 [0102.726] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.731] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.731] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.732] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.732] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.732] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.732] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.733] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.733] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.733] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.733] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.734] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.734] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.734] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.734] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.735] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0102.735] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0xe, lpOverlapped=0x0) returned 1 [0102.735] ReadFile (in: hFile=0x15c, lpBuffer=0x239c758, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x239c758*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0102.735] CloseHandle (hObject=0x15c) returned 1 [0102.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp", lpFilePart=0x0) returned 0x39 [0102.735] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dmiX.odp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dmix.odp")) returned 1 [0102.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", lpFilePart=0x0) returned 0x44 [0102.737] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", dwFileAttributes=0x80) returned 1 [0102.737] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods.Horsuke", lpFilePart=0x0) returned 0x4c [0102.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0102.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dwjjqgfyod9sdq8.ods.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0102.738] GetFileType (hFile=0x228) returned 0x1 [0102.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0102.738] GetFileType (hFile=0x228) returned 0x1 [0103.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", lpFilePart=0x0) returned 0x44 [0103.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0103.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dwjjqgfyod9sdq8.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0103.211] GetFileType (hFile=0x15c) returned 0x1 [0103.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0103.211] GetFileType (hFile=0x15c) returned 0x1 [0103.211] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.216] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.216] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.216] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.217] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.217] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.217] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.217] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.217] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.218] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.218] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.218] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.218] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.219] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.219] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.219] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.219] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.219] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.220] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.220] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.220] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x3ff, lpOverlapped=0x0) returned 1 [0103.220] ReadFile (in: hFile=0x15c, lpBuffer=0x2293748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2293748*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0103.220] CloseHandle (hObject=0x15c) returned 1 [0103.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods", lpFilePart=0x0) returned 0x44 [0103.221] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\dwjjQgfYod9sdq8.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\dwjjqgfyod9sdq8.ods")) returned 1 [0103.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", lpFilePart=0x0) returned 0x45 [0103.222] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", dwFileAttributes=0x80) returned 1 [0103.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png.Horsuke", lpFilePart=0x0) returned 0x4d [0103.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0103.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eyrqh3eg08uprsmx.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0103.227] GetFileType (hFile=0x228) returned 0x1 [0103.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0103.227] GetFileType (hFile=0x228) returned 0x1 [0103.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", lpFilePart=0x0) returned 0x45 [0103.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0103.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eyrqh3eg08uprsmx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0103.684] GetFileType (hFile=0x15c) returned 0x1 [0103.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0103.684] GetFileType (hFile=0x15c) returned 0x1 [0103.684] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.689] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.689] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.690] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.690] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0103.690] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x643, lpOverlapped=0x0) returned 1 [0103.690] ReadFile (in: hFile=0x15c, lpBuffer=0x236dc73, nNumberOfBytesToRead=0x1bd, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236dc73*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0103.690] ReadFile (in: hFile=0x15c, lpBuffer=0x236de48, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x236de48*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0103.690] CloseHandle (hObject=0x15c) returned 1 [0103.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png", lpFilePart=0x0) returned 0x45 [0103.690] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\EyRqh3EG08UprSMx.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\eyrqh3eg08uprsmx.png")) returned 1 [0103.691] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", lpFilePart=0x0) returned 0x44 [0103.691] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", dwFileAttributes=0x80) returned 1 [0103.692] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc.Horsuke", lpFilePart=0x0) returned 0x4c [0103.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0103.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\f1as91wdas5ag9o.doc.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0103.693] GetFileType (hFile=0x228) returned 0x1 [0103.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0103.693] GetFileType (hFile=0x228) returned 0x1 [0104.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", lpFilePart=0x0) returned 0x44 [0104.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0104.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\f1as91wdas5ag9o.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0104.209] GetFileType (hFile=0x15c) returned 0x1 [0104.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0104.209] GetFileType (hFile=0x15c) returned 0x1 [0104.209] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.210] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.214] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.214] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.214] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.214] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.215] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.215] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0104.215] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x76f, lpOverlapped=0x0) returned 1 [0104.215] ReadFile (in: hFile=0x15c, lpBuffer=0x225bf1f, nNumberOfBytesToRead=0x91, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bf1f*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0104.215] ReadFile (in: hFile=0x15c, lpBuffer=0x225bfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x225bfc8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0104.215] CloseHandle (hObject=0x15c) returned 1 [0104.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc", lpFilePart=0x0) returned 0x44 [0104.215] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\f1AS91wdAS5ag9o.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\f1as91wdas5ag9o.doc")) returned 1 [0104.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x47 [0104.216] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 1 [0104.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.Horsuke", lpFilePart=0x0) returned 0x4f [0104.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0104.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0104.218] GetFileType (hFile=0x228) returned 0x1 [0104.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0104.218] GetFileType (hFile=0x228) returned 0x1 [0104.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt", lpFilePart=0x0) returned 0x47 [0104.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0104.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0104.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ea670) returned 1 [0104.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0104.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.751] GetFileType (hFile=0x15c) returned 0x1 [0104.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.751] GetFileType (hFile=0x15c) returned 0x1 [0104.751] WriteFile (in: hFile=0x15c, lpBuffer=0x2356c18*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2356c18*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0104.752] CloseHandle (hObject=0x15c) returned 1 [0104.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.png", lpFilePart=0x0) returned 0x39 [0104.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0104.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0104.753] GetFileType (hFile=0x15c) returned 0x1 [0104.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0104.753] GetFileType (hFile=0x15c) returned 0x1 [0104.753] WriteFile (in: hFile=0x15c, lpBuffer=0x2357cc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2357cc0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0104.754] CloseHandle (hObject=0x15c) returned 1 [0104.754] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0104.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.754] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.755] GetFileType (hFile=0x15c) returned 0x1 [0104.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.755] GetFileType (hFile=0x15c) returned 0x1 [0104.755] WriteFile (in: hFile=0x15c, lpBuffer=0x235b830*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x235b830*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0104.755] CloseHandle (hObject=0x15c) returned 1 [0104.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0104.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.756] GetFileType (hFile=0x15c) returned 0x1 [0104.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.756] GetFileType (hFile=0x15c) returned 0x1 [0104.756] WriteFile (in: hFile=0x15c, lpBuffer=0x235e220*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x235e220*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0104.757] CloseHandle (hObject=0x15c) returned 1 [0104.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0104.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files", lpFilePart=0x0) returned 0x44 [0104.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\", lpFilePart=0x0) returned 0x45 [0104.757] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0xffffffffffffffff [0104.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0104.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.TXT", lpFilePart=0x0) returned 0x4d [0104.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.762] GetFileType (hFile=0x15c) returned 0x1 [0104.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.762] GetFileType (hFile=0x15c) returned 0x1 [0104.762] WriteFile (in: hFile=0x15c, lpBuffer=0x2369ac8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2369ac8*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0104.763] CloseHandle (hObject=0x15c) returned 1 [0104.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.png", lpFilePart=0x0) returned 0x4d [0104.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0104.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0104.764] GetFileType (hFile=0x15c) returned 0x1 [0104.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0104.764] GetFileType (hFile=0x15c) returned 0x1 [0104.764] WriteFile (in: hFile=0x15c, lpBuffer=0x236ab98*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x236ab98*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0104.765] CloseHandle (hObject=0x15c) returned 1 [0104.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.vbs", lpFilePart=0x0) returned 0x4d [0104.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.765] GetFileType (hFile=0x15c) returned 0x1 [0104.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.765] GetFileType (hFile=0x15c) returned 0x1 [0104.765] WriteFile (in: hFile=0x15c, lpBuffer=0x236e780*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x236e780*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0104.766] CloseHandle (hObject=0x15c) returned 1 [0104.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x79 [0104.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temporary Internet Files\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\temporary internet files\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.767] GetFileType (hFile=0x15c) returned 0x1 [0104.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.767] GetFileType (hFile=0x15c) returned 0x1 [0104.767] WriteFile (in: hFile=0x15c, lpBuffer=0x23711c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23711c0*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0104.768] CloseHandle (hObject=0x15c) returned 1 [0104.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0104.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0104.768] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39 [0104.768] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0104.768] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0104.769] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0104.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0104.769] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0104.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore", lpFilePart=0x0) returned 0x38 [0104.769] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\", lpFilePart=0x0) returned 0x39 [0104.769] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0104.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.769] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0104.769] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0104.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0104.771] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0104.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.772] GetFileType (hFile=0x15c) returned 0x1 [0104.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.772] GetFileType (hFile=0x15c) returned 0x1 [0104.772] WriteFile (in: hFile=0x15c, lpBuffer=0x237d2e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x237d2e8*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0104.773] CloseHandle (hObject=0x15c) returned 1 [0104.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.png", lpFilePart=0x0) returned 0x41 [0104.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0104.773] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0104.773] GetFileType (hFile=0x15c) returned 0x1 [0104.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0104.773] GetFileType (hFile=0x15c) returned 0x1 [0104.773] WriteFile (in: hFile=0x15c, lpBuffer=0x237e3a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x237e3a0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0104.774] CloseHandle (hObject=0x15c) returned 1 [0104.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0104.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.775] GetFileType (hFile=0x15c) returned 0x1 [0104.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.775] GetFileType (hFile=0x15c) returned 0x1 [0104.775] WriteFile (in: hFile=0x15c, lpBuffer=0x2381f40*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2381f40*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0104.775] CloseHandle (hObject=0x15c) returned 1 [0104.776] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0104.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0104.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\VirtualStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\virtualstore\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.784] GetFileType (hFile=0x15c) returned 0x1 [0104.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0104.784] GetFileType (hFile=0x15c) returned 0x1 [0104.784] WriteFile (in: hFile=0x15c, lpBuffer=0x2384950*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2384950*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0104.785] CloseHandle (hObject=0x15c) returned 1 [0104.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.TXT", lpFilePart=0x0) returned 0x34 [0104.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0104.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.790] GetFileType (hFile=0x15c) returned 0x1 [0104.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0104.790] GetFileType (hFile=0x15c) returned 0x1 [0104.790] WriteFile (in: hFile=0x15c, lpBuffer=0x238ec18*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x238ec18*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0104.791] CloseHandle (hObject=0x15c) returned 1 [0104.791] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.png", lpFilePart=0x0) returned 0x34 [0104.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0104.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0104.791] GetFileType (hFile=0x15c) returned 0x1 [0104.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0104.791] GetFileType (hFile=0x15c) returned 0x1 [0104.791] WriteFile (in: hFile=0x15c, lpBuffer=0x238fcb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x238fcb8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0104.792] CloseHandle (hObject=0x15c) returned 1 [0104.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.vbs", lpFilePart=0x0) returned 0x34 [0104.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0104.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.792] GetFileType (hFile=0x15c) returned 0x1 [0104.792] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0104.793] GetFileType (hFile=0x15c) returned 0x1 [0104.793] WriteFile (in: hFile=0x15c, lpBuffer=0x2393810*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2393810*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0104.793] CloseHandle (hObject=0x15c) returned 1 [0104.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x60 [0104.793] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0104.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0104.794] GetFileType (hFile=0x15c) returned 0x1 [0104.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0104.794] GetFileType (hFile=0x15c) returned 0x1 [0104.794] WriteFile (in: hFile=0x15c, lpBuffer=0x23961f0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23961f0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0104.795] CloseHandle (hObject=0x15c) returned 1 [0104.795] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0104.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", lpFilePart=0x0) returned 0x2e [0104.795] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x2f [0104.795] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0104.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.795] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0104.796] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0104.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0104.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0104.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow", lpFilePart=0x0) returned 0x2e [0104.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\", lpFilePart=0x0) returned 0x2f [0104.796] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0104.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0104.796] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0104.797] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0104.797] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0104.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0104.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x34 [0104.797] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x35 [0104.797] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0104.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0104.798] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0104.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0104.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0104.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe", lpFilePart=0x0) returned 0x34 [0104.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\", lpFilePart=0x0) returned 0x35 [0104.798] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0104.798] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0104.799] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0104.799] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0104.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0104.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0104.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3c [0104.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3d [0104.799] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0104.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0104.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0104.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0104.800] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0104.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0104.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0104.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3c [0104.800] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3d [0104.800] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0104.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0104.800] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0104.801] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0104.801] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0104.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0104.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0104.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x41 [0104.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x42 [0104.801] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0104.810] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.810] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.810] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.811] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.811] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0104.811] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0104.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0104.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0104.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x41 [0104.812] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x42 [0104.812] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0104.812] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0104.813] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0104.813] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0104.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0104.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0104.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50 [0104.814] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", dwFileAttributes=0x80) returned 1 [0104.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.Horsuke", lpFilePart=0x0) returned 0x58 [0104.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0104.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0104.816] GetFileType (hFile=0x15c) returned 0x1 [0104.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0104.816] GetFileType (hFile=0x15c) returned 0x1 [0105.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50 [0105.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0105.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0105.271] GetFileType (hFile=0x240) returned 0x1 [0105.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.271] GetFileType (hFile=0x240) returned 0x1 [0105.271] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.277] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.278] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.278] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.278] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.278] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.278] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.278] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.279] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.279] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0105.279] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x5ff, lpOverlapped=0x0) returned 1 [0105.279] ReadFile (in: hFile=0x240, lpBuffer=0x228919f, nNumberOfBytesToRead=0x201, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x228919f*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0105.279] ReadFile (in: hFile=0x240, lpBuffer=0x22893b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22893b8*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0105.279] CloseHandle (hObject=0x240) returned 1 [0105.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip", lpFilePart=0x0) returned 0x50 [0105.280] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\rdrmessage.zip" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\rdrmessage.zip")) returned 1 [0105.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x48 [0105.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x49 [0105.281] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0105.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.283] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0105.283] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0105.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0105.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search", lpFilePart=0x0) returned 0x48 [0105.283] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\", lpFilePart=0x0) returned 0x49 [0105.283] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0105.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.284] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0105.284] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0105.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0105.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.TXT", lpFilePart=0x0) returned 0x51 [0105.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0105.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.287] GetFileType (hFile=0x15c) returned 0x1 [0105.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0105.287] GetFileType (hFile=0x15c) returned 0x1 [0105.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.png", lpFilePart=0x0) returned 0x51 [0105.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0105.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.288] GetFileType (hFile=0x15c) returned 0x1 [0105.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0105.288] GetFileType (hFile=0x15c) returned 0x1 [0105.288] WriteFile (in: hFile=0x15c, lpBuffer=0x22a1448*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22a1448*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0105.289] CloseHandle (hObject=0x15c) returned 1 [0105.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.vbs", lpFilePart=0x0) returned 0x51 [0105.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0105.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.289] GetFileType (hFile=0x15c) returned 0x1 [0105.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0105.289] GetFileType (hFile=0x15c) returned 0x1 [0105.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7d [0105.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0105.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\search\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.291] GetFileType (hFile=0x15c) returned 0x1 [0105.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0105.291] GetFileType (hFile=0x15c) returned 0x1 [0105.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0105.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.292] GetFileType (hFile=0x15c) returned 0x1 [0105.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.292] GetFileType (hFile=0x15c) returned 0x1 [0105.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x4a [0105.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.293] GetFileType (hFile=0x15c) returned 0x1 [0105.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0105.293] GetFileType (hFile=0x15c) returned 0x1 [0105.293] WriteFile (in: hFile=0x15c, lpBuffer=0x22b2e78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22b2e78*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0105.294] CloseHandle (hObject=0x15c) returned 1 [0105.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0105.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.295] GetFileType (hFile=0x15c) returned 0x1 [0105.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.295] GetFileType (hFile=0x15c) returned 0x1 [0105.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0105.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\10.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.296] GetFileType (hFile=0x15c) returned 0x1 [0105.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.296] GetFileType (hFile=0x15c) returned 0x1 [0105.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.TXT", lpFilePart=0x0) returned 0x45 [0105.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.298] GetFileType (hFile=0x15c) returned 0x1 [0105.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.298] GetFileType (hFile=0x15c) returned 0x1 [0105.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x45 [0105.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.299] GetFileType (hFile=0x15c) returned 0x1 [0105.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0105.299] GetFileType (hFile=0x15c) returned 0x1 [0105.299] WriteFile (in: hFile=0x15c, lpBuffer=0x22c4840*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22c4840*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0105.300] CloseHandle (hObject=0x15c) returned 1 [0105.300] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.vbs", lpFilePart=0x0) returned 0x45 [0105.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.300] GetFileType (hFile=0x15c) returned 0x1 [0105.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.300] GetFileType (hFile=0x15c) returned 0x1 [0105.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x71 [0105.301] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\acrobat\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.314] GetFileType (hFile=0x15c) returned 0x1 [0105.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.314] GetFileType (hFile=0x15c) returned 0x1 [0105.315] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x40 [0105.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x41 [0105.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.315] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.316] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0105.316] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x40 [0105.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x41 [0105.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.316] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.316] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.316] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0105.316] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0105.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4d [0105.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4e [0105.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.422] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.422] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0105.423] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0105.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0105.423] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0105.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4d [0105.423] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4e [0105.423] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.423] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.424] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0105.424] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0105.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0105.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x65 [0105.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x66 [0105.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0105.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.445] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.446] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.447] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0105.447] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0105.447] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0105.447] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary", lpFilePart=0x0) returned 0x65 [0105.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\", lpFilePart=0x0) returned 0x66 [0105.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0105.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0105.450] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0105.450] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0105.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0105.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x69 [0105.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x6a [0105.451] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.452] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.452] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.452] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all", lpFilePart=0x0) returned 0x69 [0105.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\", lpFilePart=0x0) returned 0x6a [0105.453] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.453] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.453] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.455] GetFileType (hFile=0x15c) returned 0x1 [0105.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.455] GetFileType (hFile=0x15c) returned 0x1 [0105.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.457] GetFileType (hFile=0x15c) returned 0x1 [0105.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.457] GetFileType (hFile=0x15c) returned 0x1 [0105.457] WriteFile (in: hFile=0x15c, lpBuffer=0x22e3c58*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22e3c58*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0105.458] CloseHandle (hObject=0x15c) returned 1 [0105.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.459] GetFileType (hFile=0x15c) returned 0x1 [0105.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.459] GetFileType (hFile=0x15c) returned 0x1 [0105.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\all\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\all\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.460] GetFileType (hFile=0x15c) returned 0x1 [0105.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.460] GetFileType (hFile=0x15c) returned 0x1 [0105.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x69 [0105.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x6a [0105.461] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.462] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.462] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt", lpFilePart=0x0) returned 0x69 [0105.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\", lpFilePart=0x0) returned 0x6a [0105.463] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.463] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.463] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.463] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.463] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.464] GetFileType (hFile=0x15c) returned 0x1 [0105.464] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.464] GetFileType (hFile=0x15c) returned 0x1 [0105.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.465] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.465] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.465] GetFileType (hFile=0x15c) returned 0x1 [0105.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.465] GetFileType (hFile=0x15c) returned 0x1 [0105.466] WriteFile (in: hFile=0x15c, lpBuffer=0x22f80c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22f80c8*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0105.466] CloseHandle (hObject=0x15c) returned 1 [0105.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.467] GetFileType (hFile=0x15c) returned 0x1 [0105.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.467] GetFileType (hFile=0x15c) returned 0x1 [0105.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.469] GetFileType (hFile=0x15c) returned 0x1 [0105.469] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.469] GetFileType (hFile=0x15c) returned 0x1 [0105.469] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x69 [0105.469] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x6a [0105.470] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.470] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.471] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.471] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz", lpFilePart=0x0) returned 0x69 [0105.471] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\", lpFilePart=0x0) returned 0x6a [0105.471] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.471] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.472] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.472] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.476] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\brz\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\brz\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x69 [0105.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x6a [0105.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.478] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan", lpFilePart=0x0) returned 0x69 [0105.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\", lpFilePart=0x0) returned 0x6a [0105.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.478] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.479] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.479] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dan\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dan\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x69 [0105.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x6a [0105.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.484] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.484] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.484] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut", lpFilePart=0x0) returned 0x69 [0105.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\", lpFilePart=0x0) returned 0x6a [0105.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.485] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.485] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.490] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\dut\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\dut\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x69 [0105.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x6a [0105.491] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.491] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.492] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng", lpFilePart=0x0) returned 0x69 [0105.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\", lpFilePart=0x0) returned 0x6a [0105.492] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.492] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.492] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.493] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.495] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.495] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.497] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\eng\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\eng\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x69 [0105.500] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x6a [0105.501] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.501] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.502] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn", lpFilePart=0x0) returned 0x69 [0105.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\", lpFilePart=0x0) returned 0x6a [0105.502] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.503] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.503] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.503] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.503] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.503] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.504] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.507] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.507] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.508] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\frn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\frn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x69 [0105.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x6a [0105.510] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.510] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.511] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm", lpFilePart=0x0) returned 0x69 [0105.511] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\", lpFilePart=0x0) returned 0x6a [0105.511] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.511] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.512] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.512] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.514] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.514] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\grm\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\grm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.519] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.520] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x69 [0105.520] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x6a [0105.520] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.520] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.520] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl", lpFilePart=0x0) returned 0x69 [0105.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\", lpFilePart=0x0) returned 0x6a [0105.521] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.521] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.521] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.521] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.521] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.522] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.523] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.523] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\itl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\itl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x69 [0105.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x6a [0105.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.528] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.528] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.528] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw", lpFilePart=0x0) returned 0x69 [0105.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\", lpFilePart=0x0) returned 0x6a [0105.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.529] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.529] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.529] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.529] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.529] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.530] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\nrw\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\nrw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x69 [0105.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x6a [0105.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.536] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.536] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.536] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt", lpFilePart=0x0) returned 0x69 [0105.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\", lpFilePart=0x0) returned 0x6a [0105.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.537] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.537] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.538] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\prt\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\prt\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x69 [0105.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x6a [0105.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.543] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.543] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.543] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.543] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn", lpFilePart=0x0) returned 0x69 [0105.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\", lpFilePart=0x0) returned 0x6a [0105.543] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.544] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.544] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.544] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.547] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.548] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\spn\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\spn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.549] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x69 [0105.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x6a [0105.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.550] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.550] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.550] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd", lpFilePart=0x0) returned 0x69 [0105.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\", lpFilePart=0x0) returned 0x6a [0105.550] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0105.550] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0105.550] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0105.550] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0105.550] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0105.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.TXT", lpFilePart=0x0) returned 0x72 [0105.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.552] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.png", lpFilePart=0x0) returned 0x72 [0105.552] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0105.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0105.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.vbs", lpFilePart=0x0) returned 0x72 [0105.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9e [0105.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0105.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\swd\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\swd\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0105.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.TXT", lpFilePart=0x0) returned 0x6e [0105.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0105.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0105.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.png", lpFilePart=0x0) returned 0x6e [0105.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0105.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.558] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0105.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.vbs", lpFilePart=0x0) returned 0x6e [0105.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0105.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0105.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9a [0105.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0105.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Adobe Custom Dictionary\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\adobe custom dictionary\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0105.561] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.TXT", lpFilePart=0x0) returned 0x56 [0105.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.562] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.png", lpFilePart=0x0) returned 0x56 [0105.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0105.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.vbs", lpFilePart=0x0) returned 0x56 [0105.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.565] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.566] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x82 [0105.566] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Dictionaries\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\dictionaries\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0105.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.png", lpFilePart=0x0) returned 0x49 [0105.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0105.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.590] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0105.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Linguistics\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\linguistics\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.TXT", lpFilePart=0x0) returned 0x3d [0105.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x3d [0105.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.vbs", lpFilePart=0x0) returned 0x3d [0105.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x69 [0105.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\adobe\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x38 [0105.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x39 [0105.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0105.601] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft", lpFilePart=0x0) returned 0x38 [0105.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\", lpFilePart=0x0) returned 0x39 [0105.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.601] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0105.602] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x49 [0105.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x4a [0105.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0105.602] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache", lpFilePart=0x0) returned 0x49 [0105.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\", lpFilePart=0x0) returned 0x4a [0105.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.602] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0105.603] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0105.603] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x51 [0105.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x52 [0105.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.605] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.605] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.605] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.605] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.605] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.606] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.607] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.608] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.609] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.610] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.611] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0105.612] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content", lpFilePart=0x0) returned 0x51 [0105.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\", lpFilePart=0x0) returned 0x52 [0105.612] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.612] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.613] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.614] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.615] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.616] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.617] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0105.617] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0105.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.618] GetFileType (hFile=0x15c) returned 0x1 [0105.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.png", lpFilePart=0x0) returned 0x5a [0105.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.620] GetFileType (hFile=0x15c) returned 0x1 [0105.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0105.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.621] GetFileType (hFile=0x15c) returned 0x1 [0105.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0105.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Content\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\content\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.622] GetFileType (hFile=0x15c) returned 0x1 [0105.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x52 [0105.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x53 [0105.623] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.623] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.623] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.623] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.623] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.624] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0105.628] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0105.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0105.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0105.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData", lpFilePart=0x0) returned 0x52 [0105.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\", lpFilePart=0x0) returned 0x53 [0105.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.631] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0105.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0105.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0105.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.632] GetFileType (hFile=0x15c) returned 0x1 [0105.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.632] GetFileType (hFile=0x15c) returned 0x1 [0105.633] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.png", lpFilePart=0x0) returned 0x5b [0105.633] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0105.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.633] GetFileType (hFile=0x15c) returned 0x1 [0105.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0105.633] GetFileType (hFile=0x15c) returned 0x1 [0105.633] WriteFile (in: hFile=0x15c, lpBuffer=0x227efc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x227efc0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0105.634] CloseHandle (hObject=0x15c) returned 1 [0105.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0105.634] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.635] GetFileType (hFile=0x15c) returned 0x1 [0105.635] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.635] GetFileType (hFile=0x15c) returned 0x1 [0105.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0105.636] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0105.636] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\MetaData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.636] GetFileType (hFile=0x15c) returned 0x1 [0105.636] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0105.636] GetFileType (hFile=0x15c) returned 0x1 [0105.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0105.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.637] GetFileType (hFile=0x15c) returned 0x1 [0105.637] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.637] GetFileType (hFile=0x15c) returned 0x1 [0105.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.png", lpFilePart=0x0) returned 0x52 [0105.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.638] GetFileType (hFile=0x15c) returned 0x1 [0105.638] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0105.638] GetFileType (hFile=0x15c) returned 0x1 [0105.638] WriteFile (in: hFile=0x15c, lpBuffer=0x2290a70*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2290a70*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0105.639] CloseHandle (hObject=0x15c) returned 1 [0105.639] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0105.639] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.640] GetFileType (hFile=0x15c) returned 0x1 [0105.640] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.640] GetFileType (hFile=0x15c) returned 0x1 [0105.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0105.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\CryptnetUrlCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\cryptneturlcache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.642] GetFileType (hFile=0x15c) returned 0x1 [0105.642] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.642] GetFileType (hFile=0x15c) returned 0x1 [0105.643] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3e [0105.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3f [0105.643] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.644] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12", lpFilePart=0x0) returned 0x3e [0105.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\", lpFilePart=0x0) returned 0x3f [0105.644] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.645] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0105.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.645] GetFileType (hFile=0x15c) returned 0x1 [0105.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.645] GetFileType (hFile=0x15c) returned 0x1 [0105.646] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.png", lpFilePart=0x0) returned 0x47 [0105.646] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.646] GetFileType (hFile=0x15c) returned 0x1 [0105.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0105.647] GetFileType (hFile=0x15c) returned 0x1 [0105.647] WriteFile (in: hFile=0x15c, lpBuffer=0x22a4418*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22a4418*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0105.647] CloseHandle (hObject=0x15c) returned 1 [0105.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0105.648] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.648] GetFileType (hFile=0x15c) returned 0x1 [0105.648] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.648] GetFileType (hFile=0x15c) returned 0x1 [0105.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0105.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\ime12\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.649] GetFileType (hFile=0x15c) returned 0x1 [0105.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.649] GetFileType (hFile=0x15c) returned 0x1 [0105.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3f [0105.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x40 [0105.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.650] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12", lpFilePart=0x0) returned 0x3f [0105.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\", lpFilePart=0x0) returned 0x40 [0105.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.651] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0105.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.651] GetFileType (hFile=0x15c) returned 0x1 [0105.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.652] GetFileType (hFile=0x15c) returned 0x1 [0105.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.png", lpFilePart=0x0) returned 0x48 [0105.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0105.653] GetFileType (hFile=0x15c) returned 0x1 [0105.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0105.653] GetFileType (hFile=0x15c) returned 0x1 [0105.653] WriteFile (in: hFile=0x15c, lpBuffer=0x22b7d80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22b7d80*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0105.654] CloseHandle (hObject=0x15c) returned 1 [0105.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0105.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.654] GetFileType (hFile=0x15c) returned 0x1 [0105.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.654] GetFileType (hFile=0x15c) returned 0x1 [0105.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0105.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\imjp12\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0105.655] GetFileType (hFile=0x15c) returned 0x1 [0105.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.656] GetFileType (hFile=0x15c) returned 0x1 [0105.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x40 [0105.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x41 [0105.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.657] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1", lpFilePart=0x0) returned 0x40 [0105.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\", lpFilePart=0x0) returned 0x41 [0105.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.657] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0105.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.png", lpFilePart=0x0) returned 0x49 [0105.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0105.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0105.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP8_1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0105.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.661] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x40 [0105.661] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x41 [0105.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.661] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0", lpFilePart=0x0) returned 0x40 [0105.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\", lpFilePart=0x0) returned 0x41 [0105.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.662] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0105.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.png", lpFilePart=0x0) returned 0x49 [0105.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0105.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0105.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\IMJP9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0105.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0105.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0105.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x4a [0105.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4b [0105.666] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.667] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0105.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer", lpFilePart=0x0) returned 0x4a [0105.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\", lpFilePart=0x0) returned 0x4b [0105.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0105.667] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0105.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0105.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0105.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x53 [0105.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x54 [0105.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.668] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0105.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0105.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0105.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore", lpFilePart=0x0) returned 0x53 [0105.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\", lpFilePart=0x0) returned 0x54 [0105.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0105.668] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0105.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0105.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", lpFilePart=0x0) returned 0x5c [0105.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpFilePart=0x0) returned 0x5d [0105.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0105.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0105.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0105.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0105.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T", lpFilePart=0x0) returned 0x5c [0105.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\", lpFilePart=0x0) returned 0x5d [0105.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0105.669] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0105.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0105.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0105.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x74 [0105.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", dwFileAttributes=0x80) returned 1 [0105.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml.Horsuke", lpFilePart=0x0) returned 0x7c [0105.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0105.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0106.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x74 [0106.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0106.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0106.219] GetFileType (hFile=0x240) returned 0x1 [0106.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0106.219] GetFileType (hFile=0x240) returned 0x1 [0106.219] ReadFile (in: hFile=0x240, lpBuffer=0x23d6e38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23d6e38*, lpNumberOfBytesRead=0x2edce8*=0xd, lpOverlapped=0x0) returned 1 [0106.220] ReadFile (in: hFile=0x240, lpBuffer=0x23d6e38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23d6e38*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0106.220] CloseHandle (hObject=0x240) returned 1 [0106.220] WriteFile (in: hFile=0x15c, lpBuffer=0x23d52c8*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x23d52c8*, lpNumberOfBytesWritten=0x2edbb8*=0x30, lpOverlapped=0x0) returned 1 [0106.222] CloseHandle (hObject=0x15c) returned 1 [0106.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml", lpFilePart=0x0) returned 0x74 [0106.222] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\imagesrv.adition[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\imagesrv.adition[1].xml")) returned 1 [0106.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0106.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.225] GetFileType (hFile=0x15c) returned 0x1 [0106.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.225] GetFileType (hFile=0x15c) returned 0x1 [0106.225] WriteFile (in: hFile=0x15c, lpBuffer=0x23e1338*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23e1338*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0106.226] CloseHandle (hObject=0x15c) returned 1 [0106.226] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.png", lpFilePart=0x0) returned 0x65 [0106.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0106.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0106.227] GetFileType (hFile=0x15c) returned 0x1 [0106.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0106.227] GetFileType (hFile=0x15c) returned 0x1 [0106.227] WriteFile (in: hFile=0x15c, lpBuffer=0x23e2438*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23e2438*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0106.227] CloseHandle (hObject=0x15c) returned 1 [0106.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0106.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.228] GetFileType (hFile=0x15c) returned 0x1 [0106.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.228] GetFileType (hFile=0x15c) returned 0x1 [0106.228] WriteFile (in: hFile=0x15c, lpBuffer=0x23e60b0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x23e60b0*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0106.229] CloseHandle (hObject=0x15c) returned 1 [0106.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0106.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\36USA68T\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\36usa68t\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.238] GetFileType (hFile=0x15c) returned 0x1 [0106.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.238] GetFileType (hFile=0x15c) returned 0x1 [0106.238] WriteFile (in: hFile=0x15c, lpBuffer=0x23e8b50*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23e8b50*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0106.239] CloseHandle (hObject=0x15c) returned 1 [0106.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0106.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", lpFilePart=0x0) returned 0x5c [0106.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpFilePart=0x0) returned 0x5d [0106.239] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0106.240] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.240] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.240] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0106.241] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0106.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0106.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0106.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0106.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME", lpFilePart=0x0) returned 0x5c [0106.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\", lpFilePart=0x0) returned 0x5d [0106.241] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0106.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.241] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0106.241] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0106.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0106.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0106.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFilePart=0x0) returned 0x6e [0106.242] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", dwFileAttributes=0x80) returned 1 [0106.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.Horsuke", lpFilePart=0x0) returned 0x76 [0106.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0106.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0106.243] GetFileType (hFile=0x15c) returned 0x1 [0106.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0106.244] GetFileType (hFile=0x15c) returned 0x1 [0106.700] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFilePart=0x0) returned 0x6e [0106.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0106.700] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0106.700] GetFileType (hFile=0x240) returned 0x1 [0106.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0106.700] GetFileType (hFile=0x240) returned 0x1 [0106.700] ReadFile (in: hFile=0x240, lpBuffer=0x22d4860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22d4860*, lpNumberOfBytesRead=0x2edce8*=0xd, lpOverlapped=0x0) returned 1 [0106.701] ReadFile (in: hFile=0x240, lpBuffer=0x22d4860, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22d4860*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0106.701] CloseHandle (hObject=0x240) returned 1 [0106.701] WriteFile (in: hFile=0x15c, lpBuffer=0x22d2d08*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22d2d08*, lpNumberOfBytesWritten=0x2edbb8*=0x30, lpOverlapped=0x0) returned 1 [0106.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml", lpFilePart=0x0) returned 0x6e [0106.702] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\www.google[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\www.google[1].xml")) returned 1 [0106.703] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0106.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.704] GetFileType (hFile=0x15c) returned 0x1 [0106.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.704] GetFileType (hFile=0x15c) returned 0x1 [0106.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.png", lpFilePart=0x0) returned 0x65 [0106.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0106.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0106.706] GetFileType (hFile=0x15c) returned 0x1 [0106.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0106.706] GetFileType (hFile=0x15c) returned 0x1 [0106.706] WriteFile (in: hFile=0x15c, lpBuffer=0x22dfe50*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22dfe50*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0106.707] CloseHandle (hObject=0x15c) returned 1 [0106.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0106.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.707] GetFileType (hFile=0x15c) returned 0x1 [0106.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.707] GetFileType (hFile=0x15c) returned 0x1 [0106.707] WriteFile (in: hFile=0x15c, lpBuffer=0x22e3ac8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x22e3ac8*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0106.708] CloseHandle (hObject=0x15c) returned 1 [0106.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0106.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\3O75JDME\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\3o75jdme\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.710] GetFileType (hFile=0x15c) returned 0x1 [0106.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.710] GetFileType (hFile=0x15c) returned 0x1 [0106.710] WriteFile (in: hFile=0x15c, lpBuffer=0x22e6568*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22e6568*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0106.711] CloseHandle (hObject=0x15c) returned 1 [0106.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0106.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", lpFilePart=0x0) returned 0x5c [0106.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", lpFilePart=0x0) returned 0x5d [0106.711] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0106.712] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.712] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0106.712] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0106.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0106.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0106.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0106.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB", lpFilePart=0x0) returned 0x5c [0106.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\", lpFilePart=0x0) returned 0x5d [0106.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0106.712] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.713] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0106.713] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0106.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0106.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0106.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0106.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.716] GetFileType (hFile=0x15c) returned 0x1 [0106.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.716] GetFileType (hFile=0x15c) returned 0x1 [0106.716] WriteFile (in: hFile=0x15c, lpBuffer=0x22f2e70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22f2e70*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0106.717] CloseHandle (hObject=0x15c) returned 1 [0106.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.png", lpFilePart=0x0) returned 0x65 [0106.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0106.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0106.718] GetFileType (hFile=0x15c) returned 0x1 [0106.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0106.718] GetFileType (hFile=0x15c) returned 0x1 [0106.718] WriteFile (in: hFile=0x15c, lpBuffer=0x22f3f70*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22f3f70*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0106.719] CloseHandle (hObject=0x15c) returned 1 [0106.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0106.719] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.720] GetFileType (hFile=0x15c) returned 0x1 [0106.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.720] GetFileType (hFile=0x15c) returned 0x1 [0106.720] WriteFile (in: hFile=0x15c, lpBuffer=0x22f7be8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x22f7be8*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0106.721] CloseHandle (hObject=0x15c) returned 1 [0106.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0106.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0106.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UV0DUWVB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uv0duwvb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0106.721] GetFileType (hFile=0x15c) returned 0x1 [0106.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0106.721] GetFileType (hFile=0x15c) returned 0x1 [0106.721] WriteFile (in: hFile=0x15c, lpBuffer=0x22fa688*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22fa688*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0106.722] CloseHandle (hObject=0x15c) returned 1 [0106.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0106.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", lpFilePart=0x0) returned 0x5c [0106.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpFilePart=0x0) returned 0x5d [0106.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0106.723] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.723] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.723] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0106.723] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0106.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0106.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0106.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0106.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09", lpFilePart=0x0) returned 0x5c [0106.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\", lpFilePart=0x0) returned 0x5d [0106.723] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0106.723] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0106.724] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0106.724] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0106.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0106.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0106.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFilePart=0x0) returned 0x6b [0106.724] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", dwFileAttributes=0x80) returned 1 [0106.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.Horsuke", lpFilePart=0x0) returned 0x73 [0106.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0106.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0106.726] GetFileType (hFile=0x15c) returned 0x1 [0106.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0106.726] GetFileType (hFile=0x15c) returned 0x1 [0107.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFilePart=0x0) returned 0x6b [0107.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0107.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0107.213] GetFileType (hFile=0x240) returned 0x1 [0107.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0107.213] GetFileType (hFile=0x240) returned 0x1 [0107.213] ReadFile (in: hFile=0x240, lpBuffer=0x23e6228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23e6228*, lpNumberOfBytesRead=0x2edce8*=0x344, lpOverlapped=0x0) returned 1 [0107.232] ReadFile (in: hFile=0x240, lpBuffer=0x23e6228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23e6228*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0107.232] CloseHandle (hObject=0x240) returned 1 [0107.232] WriteFile (in: hFile=0x15c, lpBuffer=0x23e46e0*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x23e46e0*, lpNumberOfBytesWritten=0x2edbb8*=0x370, lpOverlapped=0x0) returned 1 [0107.233] CloseHandle (hObject=0x15c) returned 1 [0107.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml", lpFilePart=0x0) returned 0x6b [0107.233] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\www.msn[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\www.msn[1].xml")) returned 1 [0107.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0107.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.237] GetFileType (hFile=0x15c) returned 0x1 [0107.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.237] GetFileType (hFile=0x15c) returned 0x1 [0107.237] WriteFile (in: hFile=0x15c, lpBuffer=0x23f0a70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23f0a70*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0107.238] CloseHandle (hObject=0x15c) returned 1 [0107.238] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.png", lpFilePart=0x0) returned 0x65 [0107.238] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0107.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.239] GetFileType (hFile=0x15c) returned 0x1 [0107.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0107.239] GetFileType (hFile=0x15c) returned 0x1 [0107.239] WriteFile (in: hFile=0x15c, lpBuffer=0x23f1b70*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23f1b70*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0107.240] CloseHandle (hObject=0x15c) returned 1 [0107.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0107.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.241] GetFileType (hFile=0x15c) returned 0x1 [0107.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.241] GetFileType (hFile=0x15c) returned 0x1 [0107.241] WriteFile (in: hFile=0x15c, lpBuffer=0x23f57e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x23f57e8*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0107.241] CloseHandle (hObject=0x15c) returned 1 [0107.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0107.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\VGMTOI09\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\vgmtoi09\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.244] GetFileType (hFile=0x15c) returned 0x1 [0107.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.244] GetFileType (hFile=0x15c) returned 0x1 [0107.244] WriteFile (in: hFile=0x15c, lpBuffer=0x23f8288*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x23f8288*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0107.245] CloseHandle (hObject=0x15c) returned 1 [0107.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0107.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.247] GetFileType (hFile=0x15c) returned 0x1 [0107.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.247] GetFileType (hFile=0x15c) returned 0x1 [0107.248] WriteFile (in: hFile=0x15c, lpBuffer=0x24025f0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x24025f0*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0107.249] CloseHandle (hObject=0x15c) returned 1 [0107.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.png", lpFilePart=0x0) returned 0x5c [0107.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.258] GetFileType (hFile=0x15c) returned 0x1 [0107.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0107.258] GetFileType (hFile=0x15c) returned 0x1 [0107.258] WriteFile (in: hFile=0x15c, lpBuffer=0x24036e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x24036e0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0107.259] CloseHandle (hObject=0x15c) returned 1 [0107.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0107.259] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.260] GetFileType (hFile=0x15c) returned 0x1 [0107.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.260] GetFileType (hFile=0x15c) returned 0x1 [0107.260] WriteFile (in: hFile=0x15c, lpBuffer=0x2407328*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x2407328*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0107.261] CloseHandle (hObject=0x15c) returned 1 [0107.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0107.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\DOMStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\domstore\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.262] GetFileType (hFile=0x15c) returned 0x1 [0107.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.262] GetFileType (hFile=0x15c) returned 0x1 [0107.262] WriteFile (in: hFile=0x15c, lpBuffer=0x2409da8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2409da8*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0107.263] CloseHandle (hObject=0x15c) returned 1 [0107.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x53 [0107.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x54 [0107.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.264] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.264] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services", lpFilePart=0x0) returned 0x53 [0107.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\", lpFilePart=0x0) returned 0x54 [0107.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.265] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.265] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0107.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.266] GetFileType (hFile=0x15c) returned 0x1 [0107.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.266] GetFileType (hFile=0x15c) returned 0x1 [0107.266] WriteFile (in: hFile=0x15c, lpBuffer=0x24164d0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x24164d0*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0107.267] CloseHandle (hObject=0x15c) returned 1 [0107.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.png", lpFilePart=0x0) returned 0x5c [0107.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.267] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.268] GetFileType (hFile=0x15c) returned 0x1 [0107.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0107.268] GetFileType (hFile=0x15c) returned 0x1 [0107.268] WriteFile (in: hFile=0x15c, lpBuffer=0x24175c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x24175c0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0107.269] CloseHandle (hObject=0x15c) returned 1 [0107.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0107.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.270] GetFileType (hFile=0x15c) returned 0x1 [0107.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.270] GetFileType (hFile=0x15c) returned 0x1 [0107.270] WriteFile (in: hFile=0x15c, lpBuffer=0x241b208*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x241b208*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0107.271] CloseHandle (hObject=0x15c) returned 1 [0107.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0107.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\services\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.271] GetFileType (hFile=0x15c) returned 0x1 [0107.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.271] GetFileType (hFile=0x15c) returned 0x1 [0107.272] WriteFile (in: hFile=0x15c, lpBuffer=0x241dc88*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x241dc88*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0107.272] CloseHandle (hObject=0x15c) returned 1 [0107.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0107.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0107.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.273] GetFileType (hFile=0x15c) returned 0x1 [0107.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0107.273] GetFileType (hFile=0x15c) returned 0x1 [0107.274] WriteFile (in: hFile=0x15c, lpBuffer=0x2427fc0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2427fc0*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0107.275] CloseHandle (hObject=0x15c) returned 1 [0107.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.png", lpFilePart=0x0) returned 0x53 [0107.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0107.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.275] GetFileType (hFile=0x15c) returned 0x1 [0107.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0107.275] GetFileType (hFile=0x15c) returned 0x1 [0107.276] WriteFile (in: hFile=0x15c, lpBuffer=0x2429098*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2429098*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0107.276] CloseHandle (hObject=0x15c) returned 1 [0107.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0107.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0107.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.277] GetFileType (hFile=0x15c) returned 0x1 [0107.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0107.277] GetFileType (hFile=0x15c) returned 0x1 [0107.277] WriteFile (in: hFile=0x15c, lpBuffer=0x242cc98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x242cc98*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0107.278] CloseHandle (hObject=0x15c) returned 1 [0107.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0107.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0107.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\internet explorer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.286] GetFileType (hFile=0x15c) returned 0x1 [0107.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0107.286] GetFileType (hFile=0x15c) returned 0x1 [0107.286] WriteFile (in: hFile=0x15c, lpBuffer=0x242f6e8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x242f6e8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0107.287] CloseHandle (hObject=0x15c) returned 1 [0107.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0107.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0107.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.291] GetFileType (hFile=0x15c) returned 0x1 [0107.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0107.291] GetFileType (hFile=0x15c) returned 0x1 [0107.291] WriteFile (in: hFile=0x15c, lpBuffer=0x223ac70*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x223ac70*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0107.292] CloseHandle (hObject=0x15c) returned 1 [0107.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x41 [0107.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.293] GetFileType (hFile=0x15c) returned 0x1 [0107.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0107.293] GetFileType (hFile=0x15c) returned 0x1 [0107.293] WriteFile (in: hFile=0x15c, lpBuffer=0x223bd28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x223bd28*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0107.294] CloseHandle (hObject=0x15c) returned 1 [0107.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0107.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0107.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.295] GetFileType (hFile=0x15c) returned 0x1 [0107.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0107.295] GetFileType (hFile=0x15c) returned 0x1 [0107.295] WriteFile (in: hFile=0x15c, lpBuffer=0x223f8c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x223f8c8*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0107.296] CloseHandle (hObject=0x15c) returned 1 [0107.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0107.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0107.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\microsoft\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.297] GetFileType (hFile=0x15c) returned 0x1 [0107.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0107.297] GetFileType (hFile=0x15c) returned 0x1 [0107.297] WriteFile (in: hFile=0x15c, lpBuffer=0x22422d8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x22422d8*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0107.298] CloseHandle (hObject=0x15c) returned 1 [0107.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0107.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x32 [0107.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", lpFilePart=0x0) returned 0x33 [0107.298] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0107.302] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0107.302] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0107.302] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0107.302] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0107.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0107.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0107.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun", lpFilePart=0x0) returned 0x32 [0107.302] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\", lpFilePart=0x0) returned 0x33 [0107.302] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0107.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0107.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0107.303] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0107.303] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0107.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0107.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0107.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", lpFilePart=0x0) returned 0x37 [0107.303] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpFilePart=0x0) returned 0x38 [0107.303] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0107.304] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.304] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.304] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.305] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.305] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0107.305] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0107.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0107.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0107.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java", lpFilePart=0x0) returned 0x37 [0107.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\", lpFilePart=0x0) returned 0x38 [0107.305] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0107.305] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.306] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.306] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.306] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0107.306] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0107.306] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0107.306] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0107.306] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", lpFilePart=0x0) returned 0x3a [0107.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", lpFilePart=0x0) returned 0x3b [0107.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.307] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.307] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.308] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU", lpFilePart=0x0) returned 0x3a [0107.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\", lpFilePart=0x0) returned 0x3b [0107.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.308] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.308] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.309] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.TXT", lpFilePart=0x0) returned 0x43 [0107.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.310] GetFileType (hFile=0x15c) returned 0x1 [0107.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.310] GetFileType (hFile=0x15c) returned 0x1 [0107.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.png", lpFilePart=0x0) returned 0x43 [0107.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.312] GetFileType (hFile=0x15c) returned 0x1 [0107.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0107.312] GetFileType (hFile=0x15c) returned 0x1 [0107.312] WriteFile (in: hFile=0x15c, lpBuffer=0x2254660*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2254660*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0107.313] CloseHandle (hObject=0x15c) returned 1 [0107.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.vbs", lpFilePart=0x0) returned 0x43 [0107.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.313] GetFileType (hFile=0x15c) returned 0x1 [0107.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.314] GetFileType (hFile=0x15c) returned 0x1 [0107.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6f [0107.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\AU\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\au\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.316] GetFileType (hFile=0x15c) returned 0x1 [0107.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.316] GetFileType (hFile=0x15c) returned 0x1 [0107.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", lpFilePart=0x0) returned 0x42 [0107.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpFilePart=0x0) returned 0x43 [0107.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.318] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.319] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment", lpFilePart=0x0) returned 0x42 [0107.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\", lpFilePart=0x0) returned 0x43 [0107.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.319] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.320] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.320] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.320] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.320] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0107.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", lpFilePart=0x0) returned 0x4b [0107.320] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", lpFilePart=0x0) returned 0x4c [0107.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0107.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0107.321] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0107.321] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0107.321] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0107.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0107.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security", lpFilePart=0x0) returned 0x4b [0107.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\", lpFilePart=0x0) returned 0x4c [0107.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0107.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0107.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0107.322] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0107.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0107.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.TXT", lpFilePart=0x0) returned 0x54 [0107.322] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.322] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.323] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.png", lpFilePart=0x0) returned 0x54 [0107.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0107.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0107.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.vbs", lpFilePart=0x0) returned 0x54 [0107.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x80 [0107.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\security\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0107.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", lpFilePart=0x0) returned 0x46 [0107.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", lpFilePart=0x0) returned 0x47 [0107.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0107.329] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0107.329] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0107.330] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0107.330] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0107.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0107.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0107.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp", lpFilePart=0x0) returned 0x46 [0107.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\", lpFilePart=0x0) returned 0x47 [0107.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0107.330] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0107.330] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0107.330] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0107.331] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0107.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0107.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", lpFilePart=0x0) returned 0x49 [0107.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", lpFilePart=0x0) returned 0x4a [0107.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0107.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0107.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0107.331] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0107.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0107.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si", lpFilePart=0x0) returned 0x49 [0107.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\", lpFilePart=0x0) returned 0x4a [0107.332] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0107.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0107.332] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0107.332] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0107.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0107.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0107.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0107.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0107.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.png", lpFilePart=0x0) returned 0x52 [0107.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0107.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0107.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0107.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0107.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0107.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0107.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0107.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\si\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\si\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0107.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.TXT", lpFilePart=0x0) returned 0x4f [0107.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.png", lpFilePart=0x0) returned 0x4f [0107.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0107.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0107.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.vbs", lpFilePart=0x0) returned 0x4f [0107.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.343] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.345] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7b [0107.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0107.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\tmp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\tmp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0107.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.TXT", lpFilePart=0x0) returned 0x4b [0107.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.png", lpFilePart=0x0) returned 0x4b [0107.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0107.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.vbs", lpFilePart=0x0) returned 0x4b [0107.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x77 [0107.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Deployment\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\deployment\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", lpFilePart=0x0) returned 0x43 [0107.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpFilePart=0x0) returned 0x44 [0107.363] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.363] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.363] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45", lpFilePart=0x0) returned 0x43 [0107.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\", lpFilePart=0x0) returned 0x44 [0107.364] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0107.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0107.364] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0107.364] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0107.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0107.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0107.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.png", lpFilePart=0x0) returned 0x4c [0107.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0107.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0107.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0107.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0107.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0107.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\jre1.7.0_45\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\jre1.7.0_45\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0107.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.TXT", lpFilePart=0x0) returned 0x40 [0107.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0107.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0107.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.png", lpFilePart=0x0) returned 0x40 [0107.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0107.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0107.377] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.vbs", lpFilePart=0x0) returned 0x40 [0107.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0107.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0107.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6c [0107.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0107.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Java\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\java\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0107.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.TXT", lpFilePart=0x0) returned 0x3b [0107.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0107.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0107.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.png", lpFilePart=0x0) returned 0x3b [0107.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0107.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0107.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.vbs", lpFilePart=0x0) returned 0x3b [0107.383] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0107.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0107.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x67 [0107.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0107.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Sun\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\sun\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0107.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0107.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0107.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0107.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.png", lpFilePart=0x0) returned 0x37 [0107.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0107.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0107.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0107.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0107.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0107.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0107.401] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0107.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\LocalLow\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\locallow\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0107.402] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0107.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0107.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0107.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e [0107.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0107.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.403] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.404] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.412] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0107.413] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0107.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0107.413] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0107.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming", lpFilePart=0x0) returned 0x2d [0107.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\", lpFilePart=0x0) returned 0x2e [0107.413] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf840 [0107.413] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.414] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.415] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0107.416] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0107.416] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0107.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0107.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0107.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", lpFilePart=0x0) returned 0x36 [0107.416] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", dwFileAttributes=0x80) returned 1 [0107.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf.Horsuke", lpFilePart=0x0) returned 0x3e [0107.416] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0107.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7xb8.rtf.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0107.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", lpFilePart=0x0) returned 0x36 [0107.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0107.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7xb8.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0107.907] GetFileType (hFile=0x240) returned 0x1 [0107.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0107.908] GetFileType (hFile=0x240) returned 0x1 [0107.908] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.913] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.913] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.913] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.913] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.914] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.914] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0107.914] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x1c0, lpOverlapped=0x0) returned 1 [0107.914] ReadFile (in: hFile=0x240, lpBuffer=0x23e78d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e78d0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0107.914] CloseHandle (hObject=0x240) returned 1 [0107.914] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf", lpFilePart=0x0) returned 0x36 [0107.914] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\7xb8.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\7xb8.rtf")) returned 1 [0107.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", lpFilePart=0x0) returned 0x43 [0107.916] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", dwFileAttributes=0x80) returned 1 [0107.917] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a.Horsuke", lpFilePart=0x0) returned 0x4b [0107.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0107.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\carbk2vgnza5gqrwn.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0107.917] GetFileType (hFile=0x15c) returned 0x1 [0107.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0107.917] GetFileType (hFile=0x15c) returned 0x1 [0108.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", lpFilePart=0x0) returned 0x43 [0108.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0108.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\carbk2vgnza5gqrwn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0108.453] GetFileType (hFile=0x240) returned 0x1 [0108.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0108.453] GetFileType (hFile=0x240) returned 0x1 [0108.453] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.455] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.457] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.458] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.460] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.460] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.460] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.460] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.461] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.461] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.461] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.461] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.462] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.462] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.462] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.462] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.463] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.463] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.463] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.463] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.464] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x82f, lpOverlapped=0x0) returned 1 [0108.464] ReadFile (in: hFile=0x240, lpBuffer=0x22d72b7, nNumberOfBytesToRead=0x3d1, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d72b7*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0108.464] ReadFile (in: hFile=0x240, lpBuffer=0x22d76a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d76a0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0108.464] CloseHandle (hObject=0x240) returned 1 [0108.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a", lpFilePart=0x0) returned 0x43 [0108.464] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\CARBk2vgnZa5GQRWn.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\carbk2vgnza5gqrwn.m4a")) returned 1 [0108.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", lpFilePart=0x0) returned 0x46 [0108.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", dwFileAttributes=0x80) returned 1 [0108.467] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv.Horsuke", lpFilePart=0x0) returned 0x4e [0108.467] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0108.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\coqzuuab-gkajqscvaft.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0108.468] GetFileType (hFile=0x15c) returned 0x1 [0108.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0108.468] GetFileType (hFile=0x15c) returned 0x1 [0108.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", lpFilePart=0x0) returned 0x46 [0108.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0108.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\coqzuuab-gkajqscvaft.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0108.917] GetFileType (hFile=0x240) returned 0x1 [0108.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0108.917] GetFileType (hFile=0x240) returned 0x1 [0108.917] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.922] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.922] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.923] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.923] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.923] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.923] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.923] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.924] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.924] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.924] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.924] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.924] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.924] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.925] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.925] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0108.925] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x233, lpOverlapped=0x0) returned 1 [0108.925] ReadFile (in: hFile=0x240, lpBuffer=0x23d90e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23d90e0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0108.925] CloseHandle (hObject=0x240) returned 1 [0108.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv", lpFilePart=0x0) returned 0x46 [0108.925] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\COQZuUaB-GKAJqSCVaFT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\coqzuuab-gkajqscvaft.flv")) returned 1 [0108.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", lpFilePart=0x0) returned 0x39 [0108.927] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", dwFileAttributes=0x80) returned 1 [0108.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv.Horsuke", lpFilePart=0x0) returned 0x41 [0108.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0108.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fcrbhir.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0108.928] GetFileType (hFile=0x15c) returned 0x1 [0108.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0108.929] GetFileType (hFile=0x15c) returned 0x1 [0109.453] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", lpFilePart=0x0) returned 0x39 [0109.453] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0109.453] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fcrbhir.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0109.454] GetFileType (hFile=0x240) returned 0x1 [0109.454] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0109.454] GetFileType (hFile=0x240) returned 0x1 [0109.454] ReadFile (in: hFile=0x240, lpBuffer=0x22d21e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d21e8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d21e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d21e8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d21e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d21e8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d21e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d21e8*, lpNumberOfBytesRead=0x2edee8*=0xc24, lpOverlapped=0x0) returned 1 [0109.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d1df4, nNumberOfBytesToRead=0x3dc, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d1df4*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0109.459] ReadFile (in: hFile=0x240, lpBuffer=0x22d21e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d21e8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0109.459] CloseHandle (hObject=0x240) returned 1 [0109.460] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv", lpFilePart=0x0) returned 0x39 [0109.460] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FCrbhiR.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fcrbhir.flv")) returned 1 [0109.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", lpFilePart=0x0) returned 0x45 [0109.461] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", dwFileAttributes=0x80) returned 1 [0109.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv.Horsuke", lpFilePart=0x0) returned 0x4d [0109.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0109.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fk hvotw dlbzc8aat7.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0109.462] GetFileType (hFile=0x15c) returned 0x1 [0109.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0109.462] GetFileType (hFile=0x15c) returned 0x1 [0109.912] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", lpFilePart=0x0) returned 0x45 [0109.912] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0109.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fk hvotw dlbzc8aat7.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0109.912] GetFileType (hFile=0x240) returned 0x1 [0109.912] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0109.912] GetFileType (hFile=0x240) returned 0x1 [0109.912] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.917] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.918] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.918] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.918] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.918] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.919] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.919] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.919] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.919] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.919] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.920] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.920] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.920] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.920] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.921] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.921] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.921] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0109.922] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x722, lpOverlapped=0x0) returned 1 [0109.922] ReadFile (in: hFile=0x240, lpBuffer=0x23be722, nNumberOfBytesToRead=0xde, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be722*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0109.922] ReadFile (in: hFile=0x240, lpBuffer=0x23be818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23be818*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0109.922] CloseHandle (hObject=0x240) returned 1 [0109.922] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv", lpFilePart=0x0) returned 0x45 [0109.922] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\fK hvOtw DLbZc8aAT7.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fk hvotw dlbzc8aat7.flv")) returned 1 [0109.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", lpFilePart=0x0) returned 0x3e [0109.924] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", dwFileAttributes=0x80) returned 1 [0109.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a.Horsuke", lpFilePart=0x0) returned 0x46 [0109.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0109.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fywml4t4lanv.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0109.925] GetFileType (hFile=0x15c) returned 0x1 [0109.925] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0109.925] GetFileType (hFile=0x15c) returned 0x1 [0110.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", lpFilePart=0x0) returned 0x3e [0110.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0110.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fywml4t4lanv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0110.465] GetFileType (hFile=0x240) returned 0x1 [0110.465] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0110.465] GetFileType (hFile=0x240) returned 0x1 [0110.465] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.470] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.470] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.470] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.470] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.471] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.471] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.471] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.471] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.471] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.472] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0xabc, lpOverlapped=0x0) returned 1 [0110.472] ReadFile (in: hFile=0x240, lpBuffer=0x22b9ddc, nNumberOfBytesToRead=0x144, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9ddc*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0110.472] ReadFile (in: hFile=0x240, lpBuffer=0x22b9f38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b9f38*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0110.472] CloseHandle (hObject=0x240) returned 1 [0110.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a", lpFilePart=0x0) returned 0x3e [0110.472] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\FYWML4T4lANV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\fywml4t4lanv.m4a")) returned 1 [0110.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", lpFilePart=0x0) returned 0x41 [0110.473] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", dwFileAttributes=0x80) returned 1 [0110.474] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv.Horsuke", lpFilePart=0x0) returned 0x49 [0110.474] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0110.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h8jy1uer yegdtt.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0110.474] GetFileType (hFile=0x15c) returned 0x1 [0110.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0110.475] GetFileType (hFile=0x15c) returned 0x1 [0110.918] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", lpFilePart=0x0) returned 0x41 [0110.918] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0110.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h8jy1uer yegdtt.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0110.919] GetFileType (hFile=0x240) returned 0x1 [0110.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0110.919] GetFileType (hFile=0x240) returned 0x1 [0110.919] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.924] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.924] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.924] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.925] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.925] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.925] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.925] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.926] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.926] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.926] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.926] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.926] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.927] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.927] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.927] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.927] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.928] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0110.928] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x18, lpOverlapped=0x0) returned 1 [0110.928] ReadFile (in: hFile=0x240, lpBuffer=0x23acfc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23acfc8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0110.928] CloseHandle (hObject=0x240) returned 1 [0110.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv", lpFilePart=0x0) returned 0x41 [0110.928] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\h8jY1UeR YeGdTT.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\h8jy1uer yegdtt.flv")) returned 1 [0110.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", lpFilePart=0x0) returned 0x46 [0110.930] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", dwFileAttributes=0x80) returned 1 [0110.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv.Horsuke", lpFilePart=0x0) returned 0x4e [0110.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0110.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kqca8kzefcsahowq-sgo.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0110.932] GetFileType (hFile=0x15c) returned 0x1 [0110.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0110.932] GetFileType (hFile=0x15c) returned 0x1 [0111.388] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", lpFilePart=0x0) returned 0x46 [0111.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0111.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kqca8kzefcsahowq-sgo.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0111.389] GetFileType (hFile=0x240) returned 0x1 [0111.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0111.389] GetFileType (hFile=0x240) returned 0x1 [0111.389] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.392] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.394] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.394] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.394] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.395] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.395] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.395] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.395] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.396] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.396] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.396] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.396] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x110, lpOverlapped=0x0) returned 1 [0111.396] ReadFile (in: hFile=0x240, lpBuffer=0x22a76b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a76b8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0111.396] CloseHandle (hObject=0x240) returned 1 [0111.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv", lpFilePart=0x0) returned 0x46 [0111.397] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\kqcA8KZefcSAHOwq-SGO.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\kqca8kzefcsahowq-sgo.flv")) returned 1 [0111.403] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", lpFilePart=0x0) returned 0x36 [0111.403] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", dwFileAttributes=0x80) returned 1 [0111.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv.Horsuke", lpFilePart=0x0) returned 0x3e [0111.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0111.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lrd8.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0111.405] GetFileType (hFile=0x15c) returned 0x1 [0111.405] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0111.405] GetFileType (hFile=0x15c) returned 0x1 [0111.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", lpFilePart=0x0) returned 0x36 [0111.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0111.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lrd8.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0111.855] GetFileType (hFile=0x240) returned 0x1 [0111.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0111.855] GetFileType (hFile=0x240) returned 0x1 [0111.855] ReadFile (in: hFile=0x240, lpBuffer=0x239a568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239a568*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0111.860] ReadFile (in: hFile=0x240, lpBuffer=0x239a568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239a568*, lpNumberOfBytesRead=0x2edee8*=0x515, lpOverlapped=0x0) returned 1 [0111.860] ReadFile (in: hFile=0x240, lpBuffer=0x239a265, nNumberOfBytesToRead=0x2eb, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239a265*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0111.860] ReadFile (in: hFile=0x240, lpBuffer=0x239a568, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239a568*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0111.860] CloseHandle (hObject=0x240) returned 1 [0111.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv", lpFilePart=0x0) returned 0x36 [0111.860] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\LrD8.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\lrd8.flv")) returned 1 [0111.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", lpFilePart=0x0) returned 0x40 [0111.862] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", dwFileAttributes=0x80) returned 1 [0111.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg.Horsuke", lpFilePart=0x0) returned 0x48 [0111.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0111.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n8907as6jn_hb8.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0111.863] GetFileType (hFile=0x15c) returned 0x1 [0111.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0111.863] GetFileType (hFile=0x15c) returned 0x1 [0112.442] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", lpFilePart=0x0) returned 0x40 [0112.442] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0112.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n8907as6jn_hb8.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0112.443] GetFileType (hFile=0x240) returned 0x1 [0112.443] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0112.443] GetFileType (hFile=0x240) returned 0x1 [0112.443] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.448] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.448] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.448] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.448] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.448] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.449] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.449] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.449] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.449] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.449] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.450] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.450] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.450] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.450] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.450] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.451] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.451] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.451] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.451] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.451] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0112.452] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x19e, lpOverlapped=0x0) returned 1 [0112.452] ReadFile (in: hFile=0x240, lpBuffer=0x22824d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22824d8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0112.452] CloseHandle (hObject=0x240) returned 1 [0112.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg", lpFilePart=0x0) returned 0x40 [0112.452] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\n8907as6Jn_HB8.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\n8907as6jn_hb8.jpg")) returned 1 [0112.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", lpFilePart=0x0) returned 0x3e [0112.454] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", dwFileAttributes=0x80) returned 1 [0112.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png.Horsuke", lpFilePart=0x0) returned 0x46 [0112.454] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0112.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nc ybpudo od.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0112.455] GetFileType (hFile=0x15c) returned 0x1 [0112.455] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0112.455] GetFileType (hFile=0x15c) returned 0x1 [0113.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", lpFilePart=0x0) returned 0x3e [0113.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0113.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nc ybpudo od.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x240 [0113.176] GetFileType (hFile=0x240) returned 0x1 [0113.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0113.176] GetFileType (hFile=0x240) returned 0x1 [0113.176] ReadFile (in: hFile=0x240, lpBuffer=0x237e7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237e7f8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.182] ReadFile (in: hFile=0x240, lpBuffer=0x237e7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237e7f8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.183] ReadFile (in: hFile=0x240, lpBuffer=0x237e7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237e7f8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.183] ReadFile (in: hFile=0x240, lpBuffer=0x237e7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237e7f8*, lpNumberOfBytesRead=0x2edee8*=0x538, lpOverlapped=0x0) returned 1 [0113.183] ReadFile (in: hFile=0x240, lpBuffer=0x237e518, nNumberOfBytesToRead=0x2c8, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237e518*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0113.183] ReadFile (in: hFile=0x240, lpBuffer=0x237e7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237e7f8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0113.183] CloseHandle (hObject=0x240) returned 1 [0113.183] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png", lpFilePart=0x0) returned 0x3e [0113.183] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\nC yBPudo oD.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nc ybpudo od.png")) returned 1 [0113.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", lpFilePart=0x0) returned 0x44 [0113.199] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", dwFileAttributes=0x80) returned 1 [0113.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4.Horsuke", lpFilePart=0x0) returned 0x4c [0113.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0113.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nikaks2mhdt4uf5zlm.mp4.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0113.201] GetFileType (hFile=0x15c) returned 0x1 [0113.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0113.201] GetFileType (hFile=0x15c) returned 0x1 [0113.765] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", lpFilePart=0x0) returned 0x44 [0113.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0113.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nikaks2mhdt4uf5zlm.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0113.765] GetFileType (hFile=0x228) returned 0x1 [0113.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0113.766] GetFileType (hFile=0x228) returned 0x1 [0113.766] ReadFile (in: hFile=0x228, lpBuffer=0x224a080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x224a080*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.771] ReadFile (in: hFile=0x228, lpBuffer=0x224a080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x224a080*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.771] ReadFile (in: hFile=0x228, lpBuffer=0x224a080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x224a080*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.772] ReadFile (in: hFile=0x228, lpBuffer=0x224a080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x224a080*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0113.772] ReadFile (in: hFile=0x228, lpBuffer=0x224a080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x224a080*, lpNumberOfBytesRead=0x2edee8*=0x93c, lpOverlapped=0x0) returned 1 [0113.772] ReadFile (in: hFile=0x228, lpBuffer=0x2249da4, nNumberOfBytesToRead=0x2c4, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2249da4*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0113.772] ReadFile (in: hFile=0x228, lpBuffer=0x224a080, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x224a080*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0113.772] CloseHandle (hObject=0x228) returned 1 [0113.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4", lpFilePart=0x0) returned 0x44 [0113.773] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\NIKaks2mhDt4UF5Zlm.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\nikaks2mhdt4uf5zlm.mp4")) returned 1 [0113.773] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", lpFilePart=0x0) returned 0x37 [0113.773] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", dwFileAttributes=0x80) returned 1 [0113.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png.Horsuke", lpFilePart=0x0) returned 0x3f [0113.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0113.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o4zn2.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0113.775] GetFileType (hFile=0x15c) returned 0x1 [0113.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0113.775] GetFileType (hFile=0x15c) returned 0x1 [0114.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", lpFilePart=0x0) returned 0x37 [0114.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0114.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o4zn2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0114.255] GetFileType (hFile=0x228) returned 0x1 [0114.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0114.255] GetFileType (hFile=0x228) returned 0x1 [0114.255] ReadFile (in: hFile=0x228, lpBuffer=0x2337378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2337378*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.261] ReadFile (in: hFile=0x228, lpBuffer=0x2337378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2337378*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.261] ReadFile (in: hFile=0x228, lpBuffer=0x2337378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2337378*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.261] ReadFile (in: hFile=0x228, lpBuffer=0x2337378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2337378*, lpNumberOfBytesRead=0x2edee8*=0x268, lpOverlapped=0x0) returned 1 [0114.261] ReadFile (in: hFile=0x228, lpBuffer=0x2337378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2337378*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0114.261] CloseHandle (hObject=0x228) returned 1 [0114.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png", lpFilePart=0x0) returned 0x37 [0114.262] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\o4Zn2.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\o4zn2.png")) returned 1 [0114.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", lpFilePart=0x0) returned 0x38 [0114.263] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", dwFileAttributes=0x80) returned 1 [0114.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc.Horsuke", lpFilePart=0x0) returned 0x40 [0114.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0114.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ogpsey.doc.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0114.265] GetFileType (hFile=0x15c) returned 0x1 [0114.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0114.265] GetFileType (hFile=0x15c) returned 0x1 [0114.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", lpFilePart=0x0) returned 0x38 [0114.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0114.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ogpsey.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0114.716] GetFileType (hFile=0x228) returned 0x1 [0114.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0114.716] GetFileType (hFile=0x228) returned 0x1 [0114.716] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.718] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.721] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.721] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.721] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0114.722] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x76b, lpOverlapped=0x0) returned 1 [0114.722] ReadFile (in: hFile=0x228, lpBuffer=0x2422e1b, nNumberOfBytesToRead=0x95, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422e1b*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0114.722] ReadFile (in: hFile=0x228, lpBuffer=0x2422ec8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2422ec8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0114.722] CloseHandle (hObject=0x228) returned 1 [0114.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc", lpFilePart=0x0) returned 0x38 [0114.722] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\oGpsEy.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ogpsey.doc")) returned 1 [0114.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", lpFilePart=0x0) returned 0x36 [0114.723] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", dwFileAttributes=0x80) returned 1 [0114.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png.Horsuke", lpFilePart=0x0) returned 0x3e [0114.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0114.724] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdps.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0114.725] GetFileType (hFile=0x15c) returned 0x1 [0114.725] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0114.725] GetFileType (hFile=0x15c) returned 0x1 [0115.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", lpFilePart=0x0) returned 0x36 [0115.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0115.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdps.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0115.213] GetFileType (hFile=0x228) returned 0x1 [0115.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0115.213] GetFileType (hFile=0x228) returned 0x1 [0115.213] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.218] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.219] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.220] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.221] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.222] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.222] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0xe31, lpOverlapped=0x0) returned 1 [0115.222] ReadFile (in: hFile=0x228, lpBuffer=0x2310ee1, nNumberOfBytesToRead=0x1cf, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2310ee1*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0115.222] ReadFile (in: hFile=0x228, lpBuffer=0x23110c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23110c8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0115.222] CloseHandle (hObject=0x228) returned 1 [0115.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png", lpFilePart=0x0) returned 0x36 [0115.222] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\PDps.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\pdps.png")) returned 1 [0115.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", lpFilePart=0x0) returned 0x3a [0115.224] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", dwFileAttributes=0x80) returned 1 [0115.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg.Horsuke", lpFilePart=0x0) returned 0x42 [0115.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0115.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rrbx wti.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0115.232] GetFileType (hFile=0x15c) returned 0x1 [0115.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0115.232] GetFileType (hFile=0x15c) returned 0x1 [0115.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", lpFilePart=0x0) returned 0x3a [0115.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0115.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rrbx wti.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0115.691] GetFileType (hFile=0x228) returned 0x1 [0115.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0115.691] GetFileType (hFile=0x228) returned 0x1 [0115.691] ReadFile (in: hFile=0x228, lpBuffer=0x240eef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240eef0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0115.693] ReadFile (in: hFile=0x228, lpBuffer=0x240eef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240eef0*, lpNumberOfBytesRead=0x2edee8*=0x45a, lpOverlapped=0x0) returned 1 [0115.694] ReadFile (in: hFile=0x228, lpBuffer=0x240eb32, nNumberOfBytesToRead=0x3a6, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240eb32*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0115.694] ReadFile (in: hFile=0x228, lpBuffer=0x240eef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240eef0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0115.694] CloseHandle (hObject=0x228) returned 1 [0115.694] WriteFile (in: hFile=0x15c, lpBuffer=0x240d408*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x240d408*, lpNumberOfBytesWritten=0x2eddb8*=0x480, lpOverlapped=0x0) returned 1 [0115.695] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg", lpFilePart=0x0) returned 0x3a [0115.695] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\rRBX wTi.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\rrbx wti.jpg")) returned 1 [0115.696] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", lpFilePart=0x0) returned 0x3d [0115.696] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", dwFileAttributes=0x80) returned 1 [0115.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a.Horsuke", lpFilePart=0x0) returned 0x45 [0115.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0115.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ucp1jq 5mvg.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0115.698] GetFileType (hFile=0x15c) returned 0x1 [0115.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0115.698] GetFileType (hFile=0x15c) returned 0x1 [0116.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", lpFilePart=0x0) returned 0x3d [0116.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0116.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ucp1jq 5mvg.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0116.203] GetFileType (hFile=0x228) returned 0x1 [0116.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0116.203] GetFileType (hFile=0x228) returned 0x1 [0116.203] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.208] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.209] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.209] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.209] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.209] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.209] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.210] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.210] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.210] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.210] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.210] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.211] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.211] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.211] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.211] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.219] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x407, lpOverlapped=0x0) returned 1 [0116.219] ReadFile (in: hFile=0x228, lpBuffer=0x22f886f, nNumberOfBytesToRead=0x3f9, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f886f*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0116.219] ReadFile (in: hFile=0x228, lpBuffer=0x22f8c80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22f8c80*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0116.219] CloseHandle (hObject=0x228) returned 1 [0116.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a", lpFilePart=0x0) returned 0x3d [0116.219] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\uCp1Jq 5MvG.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\ucp1jq 5mvg.m4a")) returned 1 [0116.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", lpFilePart=0x0) returned 0x43 [0116.221] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", dwFileAttributes=0x80) returned 1 [0116.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png.Horsuke", lpFilePart=0x0) returned 0x4b [0116.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0116.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xp0ad2h 3yoiqlc2y.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0116.222] GetFileType (hFile=0x15c) returned 0x1 [0116.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0116.222] GetFileType (hFile=0x15c) returned 0x1 [0116.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", lpFilePart=0x0) returned 0x43 [0116.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0116.673] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xp0ad2h 3yoiqlc2y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0116.674] GetFileType (hFile=0x228) returned 0x1 [0116.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0116.674] GetFileType (hFile=0x228) returned 0x1 [0116.674] ReadFile (in: hFile=0x228, lpBuffer=0x23f1f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23f1f90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.678] ReadFile (in: hFile=0x228, lpBuffer=0x23f1f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23f1f90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.679] ReadFile (in: hFile=0x228, lpBuffer=0x23f1f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23f1f90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0116.679] ReadFile (in: hFile=0x228, lpBuffer=0x23f1f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23f1f90*, lpNumberOfBytesRead=0x2edee8*=0x131, lpOverlapped=0x0) returned 1 [0116.679] ReadFile (in: hFile=0x228, lpBuffer=0x23f1f90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23f1f90*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0116.679] CloseHandle (hObject=0x228) returned 1 [0116.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png", lpFilePart=0x0) returned 0x43 [0116.679] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\xp0aD2h 3YoIQlC2y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\xp0ad2h 3yoiqlc2y.png")) returned 1 [0116.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", lpFilePart=0x0) returned 0x3a [0116.681] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", dwFileAttributes=0x80) returned 1 [0116.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi.Horsuke", lpFilePart=0x0) returned 0x42 [0116.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0116.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yjewegtl.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0116.682] GetFileType (hFile=0x15c) returned 0x1 [0116.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0116.682] GetFileType (hFile=0x15c) returned 0x1 [0117.127] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", lpFilePart=0x0) returned 0x3a [0117.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0117.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yjewegtl.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0117.128] GetFileType (hFile=0x228) returned 0x1 [0117.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0117.128] GetFileType (hFile=0x228) returned 0x1 [0117.128] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.133] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.133] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.133] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.133] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.133] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.134] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.134] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.134] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.134] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.134] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.135] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0117.136] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x9c4, lpOverlapped=0x0) returned 1 [0117.136] ReadFile (in: hFile=0x228, lpBuffer=0x22dd86c, nNumberOfBytesToRead=0x23c, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22dd86c*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0117.136] ReadFile (in: hFile=0x228, lpBuffer=0x22ddac0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22ddac0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0117.136] CloseHandle (hObject=0x228) returned 1 [0117.136] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi", lpFilePart=0x0) returned 0x3a [0117.136] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\YjeWEgtL.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\yjewegtl.avi")) returned 1 [0117.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0117.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0117.138] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34 [0117.138] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0117.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.154] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.155] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.155] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0117.155] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0117.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0117.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0117.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe", lpFilePart=0x0) returned 0x33 [0117.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\", lpFilePart=0x0) returned 0x34 [0117.156] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0117.156] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0117.157] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0117.157] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0117.158] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0117.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0117.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0117.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c [0117.158] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0117.159] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0117.159] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0117.159] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0117.159] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0117.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0117.159] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0117.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x3b [0117.159] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x3c [0117.159] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0117.159] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0117.160] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0117.160] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0117.160] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0117.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0117.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0117.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0117.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41 [0117.160] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0117.160] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.160] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0117.161] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0117.161] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0117.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0117.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x40 [0117.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x41 [0117.161] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0117.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.161] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0117.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0117.162] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0117.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0117.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0117.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0117.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48 [0117.162] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0117.162] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0117.163] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0117.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0117.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0117.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab", lpFilePart=0x0) returned 0x47 [0117.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\", lpFilePart=0x0) returned 0x48 [0117.163] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0117.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.163] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0117.163] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0117.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0117.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0117.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0117.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0117.166] GetFileType (hFile=0x15c) returned 0x1 [0117.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0117.166] GetFileType (hFile=0x15c) returned 0x1 [0117.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.png", lpFilePart=0x0) returned 0x50 [0117.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0117.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0117.168] GetFileType (hFile=0x15c) returned 0x1 [0117.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0117.168] GetFileType (hFile=0x15c) returned 0x1 [0117.168] WriteFile (in: hFile=0x15c, lpBuffer=0x23043e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23043e0*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0117.168] CloseHandle (hObject=0x15c) returned 1 [0117.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0117.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0117.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0117.169] GetFileType (hFile=0x15c) returned 0x1 [0117.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0117.169] GetFileType (hFile=0x15c) returned 0x1 [0117.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0117.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0117.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Collab\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\collab\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0117.170] GetFileType (hFile=0x15c) returned 0x1 [0117.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0117.170] GetFileType (hFile=0x15c) returned 0x1 [0117.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0117.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0117.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47 [0117.171] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0117.171] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0117.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0117.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0117.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0117.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms", lpFilePart=0x0) returned 0x46 [0117.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\", lpFilePart=0x0) returned 0x47 [0117.172] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0117.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.172] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0117.172] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0117.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0117.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.TXT", lpFilePart=0x0) returned 0x4f [0117.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0117.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0117.174] GetFileType (hFile=0x15c) returned 0x1 [0117.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0117.174] GetFileType (hFile=0x15c) returned 0x1 [0117.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.png", lpFilePart=0x0) returned 0x4f [0117.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0117.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0117.175] GetFileType (hFile=0x15c) returned 0x1 [0117.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0117.175] GetFileType (hFile=0x15c) returned 0x1 [0117.175] WriteFile (in: hFile=0x15c, lpBuffer=0x2317f58*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x2317f58*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0117.176] CloseHandle (hObject=0x15c) returned 1 [0117.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.vbs", lpFilePart=0x0) returned 0x4f [0117.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0117.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0117.176] GetFileType (hFile=0x15c) returned 0x1 [0117.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0117.176] GetFileType (hFile=0x15c) returned 0x1 [0117.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7b [0117.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0117.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Forms\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\forms\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0117.178] GetFileType (hFile=0x15c) returned 0x1 [0117.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0117.178] GetFileType (hFile=0x15c) returned 0x1 [0117.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0117.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0117.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d [0117.179] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0117.179] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.179] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.179] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.179] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0117.179] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0117.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0117.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0117.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts", lpFilePart=0x0) returned 0x4c [0117.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\", lpFilePart=0x0) returned 0x4d [0117.180] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0117.180] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.180] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.180] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0117.180] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0117.180] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0117.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0117.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0117.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54 [0117.180] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", dwFileAttributes=0x80) returned 1 [0117.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.Horsuke", lpFilePart=0x0) returned 0x5c [0117.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0117.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0117.182] GetFileType (hFile=0x15c) returned 0x1 [0117.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0117.182] GetFileType (hFile=0x15c) returned 0x1 [0117.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54 [0117.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0117.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0117.652] GetFileType (hFile=0x228) returned 0x1 [0117.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0117.652] GetFileType (hFile=0x228) returned 0x1 [0117.652] ReadFile (in: hFile=0x228, lpBuffer=0x240a858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x240a858*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0117.652] CloseHandle (hObject=0x228) returned 1 [0117.652] WriteFile (in: hFile=0x15c, lpBuffer=0x2408d48*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x2408d48*, lpNumberOfBytesWritten=0x2edbb8*=0x30, lpOverlapped=0x0) returned 1 [0117.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js", lpFilePart=0x0) returned 0x54 [0117.653] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.js")) returned 1 [0117.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d [0117.654] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", dwFileAttributes=0x80) returned 1 [0117.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.Horsuke", lpFilePart=0x0) returned 0x65 [0117.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0117.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0117.656] GetFileType (hFile=0x15c) returned 0x1 [0117.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0117.656] GetFileType (hFile=0x15c) returned 0x1 [0118.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d [0118.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0118.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0118.117] GetFileType (hFile=0x228) returned 0x1 [0118.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0118.117] GetFileType (hFile=0x228) returned 0x1 [0118.117] ReadFile (in: hFile=0x228, lpBuffer=0x22f32b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22f32b8*, lpNumberOfBytesRead=0x2edce8*=0xa, lpOverlapped=0x0) returned 1 [0118.118] ReadFile (in: hFile=0x228, lpBuffer=0x22f32b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22f32b8*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0118.118] CloseHandle (hObject=0x228) returned 1 [0118.118] WriteFile (in: hFile=0x15c, lpBuffer=0x22f1780*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x22f1780*, lpNumberOfBytesWritten=0x2edbb8*=0x30, lpOverlapped=0x0) returned 1 [0118.119] CloseHandle (hObject=0x15c) returned 1 [0118.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js", lpFilePart=0x0) returned 0x5d [0118.119] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\glob.settings.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\glob.settings.js")) returned 1 [0118.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.TXT", lpFilePart=0x0) returned 0x55 [0118.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.123] GetFileType (hFile=0x15c) returned 0x1 [0118.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.123] GetFileType (hFile=0x15c) returned 0x1 [0118.123] WriteFile (in: hFile=0x15c, lpBuffer=0x22fd748*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x22fd748*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0118.124] CloseHandle (hObject=0x15c) returned 1 [0118.124] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.png", lpFilePart=0x0) returned 0x55 [0118.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0118.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.124] GetFileType (hFile=0x15c) returned 0x1 [0118.124] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0118.124] GetFileType (hFile=0x15c) returned 0x1 [0118.124] WriteFile (in: hFile=0x15c, lpBuffer=0x22fe828*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22fe828*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0118.125] CloseHandle (hObject=0x15c) returned 1 [0118.125] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.vbs", lpFilePart=0x0) returned 0x55 [0118.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.126] GetFileType (hFile=0x15c) returned 0x1 [0118.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.126] GetFileType (hFile=0x15c) returned 0x1 [0118.126] WriteFile (in: hFile=0x15c, lpBuffer=0x2302440*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x2302440*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0118.126] CloseHandle (hObject=0x15c) returned 1 [0118.126] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x81 [0118.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\JavaScripts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\javascripts\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.127] GetFileType (hFile=0x15c) returned 0x1 [0118.127] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.127] GetFileType (hFile=0x15c) returned 0x1 [0118.127] WriteFile (in: hFile=0x15c, lpBuffer=0x2304ea0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x2304ea0*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0118.128] CloseHandle (hObject=0x15c) returned 1 [0118.128] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0118.128] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a [0118.128] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.128] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.128] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.129] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.129] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security", lpFilePart=0x0) returned 0x49 [0118.129] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\", lpFilePart=0x0) returned 0x4a [0118.129] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.129] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.129] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.130] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.130] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.130] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52 [0118.130] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x53 [0118.130] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0118.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.131] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0118.131] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0118.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0118.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache", lpFilePart=0x0) returned 0x52 [0118.131] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\", lpFilePart=0x0) returned 0x53 [0118.132] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0118.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.132] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0118.132] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0118.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0118.134] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0118.134] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0118.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.136] GetFileType (hFile=0x15c) returned 0x1 [0118.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0118.136] GetFileType (hFile=0x15c) returned 0x1 [0118.136] WriteFile (in: hFile=0x15c, lpBuffer=0x2314e90*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2314e90*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0118.137] CloseHandle (hObject=0x15c) returned 1 [0118.137] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.png", lpFilePart=0x0) returned 0x5b [0118.137] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0118.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.140] GetFileType (hFile=0x15c) returned 0x1 [0118.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0118.141] GetFileType (hFile=0x15c) returned 0x1 [0118.141] WriteFile (in: hFile=0x15c, lpBuffer=0x2315f78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x2315f78*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0118.141] CloseHandle (hObject=0x15c) returned 1 [0118.142] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0118.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0118.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.142] GetFileType (hFile=0x15c) returned 0x1 [0118.142] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0118.142] GetFileType (hFile=0x15c) returned 0x1 [0118.142] WriteFile (in: hFile=0x15c, lpBuffer=0x2319ba8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2319ba8*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0118.143] CloseHandle (hObject=0x15c) returned 1 [0118.143] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0118.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0118.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\CRLCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\crlcache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.143] GetFileType (hFile=0x15c) returned 0x1 [0118.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0118.143] GetFileType (hFile=0x15c) returned 0x1 [0118.143] WriteFile (in: hFile=0x15c, lpBuffer=0x231c618*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x231c618*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0118.144] CloseHandle (hObject=0x15c) returned 1 [0118.144] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0118.144] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.144] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.145] GetFileType (hFile=0x15c) returned 0x1 [0118.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.145] GetFileType (hFile=0x15c) returned 0x1 [0118.145] WriteFile (in: hFile=0x15c, lpBuffer=0x2326950*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x2326950*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0118.146] CloseHandle (hObject=0x15c) returned 1 [0118.146] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.png", lpFilePart=0x0) returned 0x52 [0118.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0118.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.146] GetFileType (hFile=0x15c) returned 0x1 [0118.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0118.146] GetFileType (hFile=0x15c) returned 0x1 [0118.146] WriteFile (in: hFile=0x15c, lpBuffer=0x2327a28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x2327a28*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0118.147] CloseHandle (hObject=0x15c) returned 1 [0118.147] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0118.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.148] GetFileType (hFile=0x15c) returned 0x1 [0118.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.148] GetFileType (hFile=0x15c) returned 0x1 [0118.148] WriteFile (in: hFile=0x15c, lpBuffer=0x232b628*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x232b628*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0118.149] CloseHandle (hObject=0x15c) returned 1 [0118.149] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0118.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.149] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\security\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.150] GetFileType (hFile=0x15c) returned 0x1 [0118.150] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.150] GetFileType (hFile=0x15c) returned 0x1 [0118.150] WriteFile (in: hFile=0x15c, lpBuffer=0x232e078*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x232e078*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0118.151] CloseHandle (hObject=0x15c) returned 1 [0118.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0118.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.152] GetFileType (hFile=0x15c) returned 0x1 [0118.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.152] GetFileType (hFile=0x15c) returned 0x1 [0118.152] WriteFile (in: hFile=0x15c, lpBuffer=0x2338390*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2338390*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0118.153] CloseHandle (hObject=0x15c) returned 1 [0118.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x49 [0118.153] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.155] GetFileType (hFile=0x15c) returned 0x1 [0118.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0118.155] GetFileType (hFile=0x15c) returned 0x1 [0118.155] WriteFile (in: hFile=0x15c, lpBuffer=0x2339458*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2339458*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0118.155] CloseHandle (hObject=0x15c) returned 1 [0118.156] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0118.156] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.156] GetFileType (hFile=0x15c) returned 0x1 [0118.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.156] GetFileType (hFile=0x15c) returned 0x1 [0118.156] WriteFile (in: hFile=0x15c, lpBuffer=0x233d028*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x233d028*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0118.157] CloseHandle (hObject=0x15c) returned 1 [0118.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0118.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\10.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.157] GetFileType (hFile=0x15c) returned 0x1 [0118.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.157] GetFileType (hFile=0x15c) returned 0x1 [0118.157] WriteFile (in: hFile=0x15c, lpBuffer=0x233fa58*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x233fa58*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0118.158] CloseHandle (hObject=0x15c) returned 1 [0118.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0118.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.159] GetFileType (hFile=0x15c) returned 0x1 [0118.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.159] GetFileType (hFile=0x15c) returned 0x1 [0118.159] WriteFile (in: hFile=0x15c, lpBuffer=0x2349d60*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2349d60*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0118.160] CloseHandle (hObject=0x15c) returned 1 [0118.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x44 [0118.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.160] GetFileType (hFile=0x15c) returned 0x1 [0118.160] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0118.160] GetFileType (hFile=0x15c) returned 0x1 [0118.160] WriteFile (in: hFile=0x15c, lpBuffer=0x234ae20*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x234ae20*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0118.161] CloseHandle (hObject=0x15c) returned 1 [0118.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0118.161] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.162] GetFileType (hFile=0x15c) returned 0x1 [0118.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.162] GetFileType (hFile=0x15c) returned 0x1 [0118.162] WriteFile (in: hFile=0x15c, lpBuffer=0x234e9d8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x234e9d8*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0118.163] CloseHandle (hObject=0x15c) returned 1 [0118.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0118.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\acrobat\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.164] GetFileType (hFile=0x15c) returned 0x1 [0118.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.164] GetFileType (hFile=0x15c) returned 0x1 [0118.164] WriteFile (in: hFile=0x15c, lpBuffer=0x23513f8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x23513f8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0118.165] CloseHandle (hObject=0x15c) returned 1 [0118.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0118.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41 [0118.165] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.166] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.166] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.166] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.166] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player", lpFilePart=0x0) returned 0x40 [0118.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\", lpFilePart=0x0) returned 0x41 [0118.167] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.167] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.167] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.167] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0118.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c [0118.168] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.168] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.168] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.168] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache", lpFilePart=0x0) returned 0x4b [0118.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\", lpFilePart=0x0) returned 0x4c [0118.169] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.169] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.169] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0118.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55 [0118.170] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.176] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.176] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.176] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R", lpFilePart=0x0) returned 0x54 [0118.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\", lpFilePart=0x0) returned 0x55 [0118.177] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.177] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.177] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.177] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0118.177] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.178] GetFileType (hFile=0x15c) returned 0x1 [0118.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.178] GetFileType (hFile=0x15c) returned 0x1 [0118.178] WriteFile (in: hFile=0x15c, lpBuffer=0x2362600*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x2362600*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0118.179] CloseHandle (hObject=0x15c) returned 1 [0118.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.png", lpFilePart=0x0) returned 0x5d [0118.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0118.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.180] GetFileType (hFile=0x15c) returned 0x1 [0118.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0118.180] GetFileType (hFile=0x15c) returned 0x1 [0118.180] WriteFile (in: hFile=0x15c, lpBuffer=0x23636f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x23636f0*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0118.181] CloseHandle (hObject=0x15c) returned 1 [0118.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0118.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.181] GetFileType (hFile=0x15c) returned 0x1 [0118.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.181] GetFileType (hFile=0x15c) returned 0x1 [0118.181] WriteFile (in: hFile=0x15c, lpBuffer=0x2367338*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x2367338*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0118.182] CloseHandle (hObject=0x15c) returned 1 [0118.182] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0118.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\D5NTRC6R\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\d5ntrc6r\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.182] GetFileType (hFile=0x15c) returned 0x1 [0118.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.183] GetFileType (hFile=0x15c) returned 0x1 [0118.183] WriteFile (in: hFile=0x15c, lpBuffer=0x2369db8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x2369db8*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0118.183] CloseHandle (hObject=0x15c) returned 1 [0118.184] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.TXT", lpFilePart=0x0) returned 0x54 [0118.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.184] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.185] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.png", lpFilePart=0x0) returned 0x54 [0118.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.185] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.186] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0118.187] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.vbs", lpFilePart=0x0) returned 0x54 [0118.187] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x80 [0118.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\AssetCache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\assetcache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.190] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0118.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.png", lpFilePart=0x0) returned 0x49 [0118.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0118.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0118.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.194] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0118.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Flash Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\flash player\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0118.196] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f [0118.196] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.197] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights", lpFilePart=0x0) returned 0x3e [0118.197] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\", lpFilePart=0x0) returned 0x3f [0118.197] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.197] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.197] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0118.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.199] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.png", lpFilePart=0x0) returned 0x47 [0118.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0118.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0118.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.201] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0118.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Headlights\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\headlights\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.203] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.203] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0118.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40 [0118.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.204] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.204] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics", lpFilePart=0x0) returned 0x3f [0118.204] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\", lpFilePart=0x0) returned 0x40 [0118.204] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.205] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0118.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d [0118.205] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.205] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries", lpFilePart=0x0) returned 0x4c [0118.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\", lpFilePart=0x0) returned 0x4d [0118.206] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.206] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.206] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.206] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.206] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.TXT", lpFilePart=0x0) returned 0x55 [0118.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.png", lpFilePart=0x0) returned 0x55 [0118.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.208] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0118.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.vbs", lpFilePart=0x0) returned 0x55 [0118.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.209] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x81 [0118.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Dictionaries\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\dictionaries\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0118.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.png", lpFilePart=0x0) returned 0x48 [0118.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0118.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0118.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0118.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Linguistics\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\linguistics\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0118.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42 [0118.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.219] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.219] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2", lpFilePart=0x0) returned 0x41 [0118.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\", lpFilePart=0x0) returned 0x42 [0118.219] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.220] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.220] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.220] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0118.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.png", lpFilePart=0x0) returned 0x4a [0118.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0118.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0118.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0118.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\LogTransport2\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\logtransport2\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0118.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0118.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0118.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x3c [0118.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0118.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0118.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0118.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.228] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0118.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0118.229] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0118.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\adobe\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0118.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0118.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0118.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39 [0118.230] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0118.231] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.231] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.231] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0118.231] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0118.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0118.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0118.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities", lpFilePart=0x0) returned 0x38 [0118.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\", lpFilePart=0x0) returned 0x39 [0118.231] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0118.231] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.232] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.232] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0118.232] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0118.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0118.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0118.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60 [0118.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.232] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.232] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.232] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}", lpFilePart=0x0) returned 0x5f [0118.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\", lpFilePart=0x0) returned 0x60 [0118.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.233] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.233] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.TXT", lpFilePart=0x0) returned 0x68 [0118.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.235] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.png", lpFilePart=0x0) returned 0x68 [0118.235] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0118.236] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.vbs", lpFilePart=0x0) returned 0x68 [0118.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x94 [0118.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0118.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\{31810C36-5D23-4CCE-A3B4-316DED195C38}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\{31810c36-5d23-4cce-a3b4-316ded195c38}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.239] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0118.240] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0118.240] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0118.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0118.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.png", lpFilePart=0x0) returned 0x41 [0118.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0118.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0118.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0118.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0118.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0118.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0118.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Identities\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\identities\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0118.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0118.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0118.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39 [0118.247] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0118.247] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.247] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.247] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0118.247] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0118.247] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0118.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0118.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia", lpFilePart=0x0) returned 0x38 [0118.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\", lpFilePart=0x0) returned 0x39 [0118.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0118.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.248] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0118.248] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0118.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0118.248] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0118.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46 [0118.248] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.249] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0118.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player", lpFilePart=0x0) returned 0x45 [0118.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\", lpFilePart=0x0) returned 0x46 [0118.249] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.249] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.250] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.250] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0118.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0118.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0118.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55 [0118.250] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.251] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.251] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects", lpFilePart=0x0) returned 0x54 [0118.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\", lpFilePart=0x0) returned 0x55 [0118.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.252] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.252] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.252] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.252] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0118.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e [0118.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.253] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.253] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.253] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB", lpFilePart=0x0) returned 0x5d [0118.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\", lpFilePart=0x0) returned 0x5e [0118.254] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.254] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.254] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.254] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.254] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.TXT", lpFilePart=0x0) returned 0x66 [0118.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.png", lpFilePart=0x0) returned 0x66 [0118.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0118.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0118.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.vbs", lpFilePart=0x0) returned 0x66 [0118.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x92 [0118.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0118.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\P7Y3F7QB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\p7y3f7qb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0118.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0118.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.png", lpFilePart=0x0) returned 0x5d [0118.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0118.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0118.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0118.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0118.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\#SharedObjects\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\#sharedobjects\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0118.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0118.273] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55 [0118.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.274] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0118.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com", lpFilePart=0x0) returned 0x54 [0118.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\", lpFilePart=0x0) returned 0x55 [0118.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.274] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.275] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0118.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0118.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0118.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d [0118.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.275] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.275] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0118.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support", lpFilePart=0x0) returned 0x5c [0118.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\", lpFilePart=0x0) returned 0x5d [0118.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.276] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.276] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0118.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68 [0118.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x69 [0118.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0118.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0118.277] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0118.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0118.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0118.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer", lpFilePart=0x0) returned 0x68 [0118.277] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\", lpFilePart=0x0) returned 0x69 [0118.277] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf840 [0118.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0118.277] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0118.278] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0118.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0118.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0118.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c [0118.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x6d [0118.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0118.278] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0118.278] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0118.278] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0118.278] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0118.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0118.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys", lpFilePart=0x0) returned 0x6c [0118.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\", lpFilePart=0x0) returned 0x6d [0118.278] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf840 [0118.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0118.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0118.279] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0118.279] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.TXT", lpFilePart=0x0) returned 0x75 [0118.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.png", lpFilePart=0x0) returned 0x75 [0118.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.vbs", lpFilePart=0x0) returned 0x75 [0118.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.282] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa1 [0118.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\sys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\sys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.TXT", lpFilePart=0x0) returned 0x71 [0118.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.285] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.png", lpFilePart=0x0) returned 0x71 [0118.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.vbs", lpFilePart=0x0) returned 0x71 [0118.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9d [0118.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\flashplayer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\flashplayer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.289] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0118.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.png", lpFilePart=0x0) returned 0x65 [0118.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0118.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0118.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\support\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\support\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.TXT", lpFilePart=0x0) returned 0x5d [0118.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.png", lpFilePart=0x0) returned 0x5d [0118.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.vbs", lpFilePart=0x0) returned 0x5d [0118.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x89 [0118.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\macromedia.com\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\macromedia.com\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.TXT", lpFilePart=0x0) returned 0x4e [0118.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.png", lpFilePart=0x0) returned 0x4e [0118.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.vbs", lpFilePart=0x0) returned 0x4e [0118.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7a [0118.315] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Flash Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\flash player\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0118.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.png", lpFilePart=0x0) returned 0x41 [0118.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0118.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0118.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Macromedia\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\macromedia\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0118.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38 [0118.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.322] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0118.323] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft", lpFilePart=0x0) returned 0x37 [0118.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\", lpFilePart=0x0) returned 0x38 [0118.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf840 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.323] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0118.324] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0118.324] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0118.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f [0118.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.325] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns", lpFilePart=0x0) returned 0x3e [0118.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\", lpFilePart=0x0) returned 0x3f [0118.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.325] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.326] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.326] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0118.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.png", lpFilePart=0x0) returned 0x47 [0118.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0118.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0118.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\AddIns\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\addins\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0118.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44 [0118.330] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.331] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials", lpFilePart=0x0) returned 0x43 [0118.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\", lpFilePart=0x0) returned 0x44 [0118.331] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.331] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.331] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0118.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.png", lpFilePart=0x0) returned 0x4c [0118.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0118.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0118.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Credentials\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\credentials\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0118.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f [0118.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.338] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.338] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x3e [0118.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x3f [0118.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.339] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0118.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43 [0118.339] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.339] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.339] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x42 [0118.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x43 [0118.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.340] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.340] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.340] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.340] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0118.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72 [0118.340] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.350] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.350] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.350] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.350] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.350] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.350] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x71 [0118.351] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x72 [0118.351] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.352] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.352] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT", lpFilePart=0x0) returned 0x7a [0118.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png", lpFilePart=0x0) returned 0x7a [0118.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs", lpFilePart=0x0) returned 0x7a [0118.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa6 [0118.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-3388679973-3930757225-3770151564-1000\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.TXT", lpFilePart=0x0) returned 0x4b [0118.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.png", lpFilePart=0x0) returned 0x4b [0118.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.vbs", lpFilePart=0x0) returned 0x4b [0118.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x77 [0118.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\rsa\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0118.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.png", lpFilePart=0x0) returned 0x47 [0118.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0118.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.368] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0118.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\crypto\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0118.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51 [0118.370] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.370] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.370] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks", lpFilePart=0x0) returned 0x50 [0118.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\", lpFilePart=0x0) returned 0x51 [0118.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.371] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0118.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56 [0118.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.371] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.371] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033", lpFilePart=0x0) returned 0x55 [0118.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\", lpFilePart=0x0) returned 0x56 [0118.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.372] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.372] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.372] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.372] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0118.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59 [0118.372] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.374] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14", lpFilePart=0x0) returned 0x58 [0118.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\", lpFilePart=0x0) returned 0x59 [0118.374] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf840 [0118.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0118.374] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0118.374] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0118.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.png", lpFilePart=0x0) returned 0x61 [0118.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.379] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0118.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0118.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\14\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\14\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.TXT", lpFilePart=0x0) returned 0x5e [0118.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.393] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.png", lpFilePart=0x0) returned 0x5e [0118.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.vbs", lpFilePart=0x0) returned 0x5e [0118.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.395] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8a [0118.395] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\1033\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.TXT", lpFilePart=0x0) returned 0x59 [0118.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.png", lpFilePart=0x0) returned 0x59 [0118.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.vbs", lpFilePart=0x0) returned 0x59 [0118.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.401] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x85 [0118.401] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Document Building Blocks\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\document building blocks\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0118.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e [0118.409] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.409] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.409] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel", lpFilePart=0x0) returned 0x3d [0118.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\", lpFilePart=0x0) returned 0x3e [0118.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.410] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0118.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46 [0118.410] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.410] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.410] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART", lpFilePart=0x0) returned 0x45 [0118.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\", lpFilePart=0x0) returned 0x46 [0118.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.411] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0118.411] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.TXT", lpFilePart=0x0) returned 0x4e [0118.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.png", lpFilePart=0x0) returned 0x4e [0118.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.413] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.vbs", lpFilePart=0x0) returned 0x4e [0118.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\XLSTART\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\xlstart\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Excel\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\excel\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.428] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.428] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.429] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.429] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.429] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.429] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.429] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IME12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ime12\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.433] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.434] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.434] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.434] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.434] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP12\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp12\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.438] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.438] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.439] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.439] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.439] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.439] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.439] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP8_1\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp8_1\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.443] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.443] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.443] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.443] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.444] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.444] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.444] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.447] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\IMJP9_0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\imjp9_0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0118.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.448] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.448] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf840 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0118.448] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0118.449] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.449] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.449] FindNextFileW (in: hFindFile=0x4cf840, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0118.449] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.449] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf840 [0118.449] FindClose (in: hFindFile=0x4cf840 | out: hFindFile=0x4cf840) returned 1 [0118.450] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0118.909] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFilePart=0x0) returned 0x68 [0118.909] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0118.909] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0118.910] GetFileType (hFile=0x228) returned 0x1 [0118.910] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0118.910] GetFileType (hFile=0x228) returned 0x1 [0118.910] ReadFile (in: hFile=0x228, lpBuffer=0x22c9418, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22c9418*, lpNumberOfBytesRead=0x2edd68*=0x8e9, lpOverlapped=0x0) returned 1 [0118.927] ReadFile (in: hFile=0x228, lpBuffer=0x22c90e9, nNumberOfBytesToRead=0x317, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22c90e9*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0118.928] ReadFile (in: hFile=0x228, lpBuffer=0x22c9418, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x22c9418*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0118.928] CloseHandle (hObject=0x228) returned 1 [0118.928] WriteFile (in: hFile=0x15c, lpBuffer=0x22c78c8*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x22c78c8*, lpNumberOfBytesWritten=0x2edc38*=0x910, lpOverlapped=0x0) returned 1 [0118.929] CloseHandle (hObject=0x15c) returned 1 [0118.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk", lpFilePart=0x0) returned 0x68 [0118.929] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\google chrome.lnk")) returned 1 [0118.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFilePart=0x0) returned 0x7b [0118.930] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", dwFileAttributes=0x80) returned 1 [0118.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.Horsuke", lpFilePart=0x0) returned 0x83 [0118.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0118.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0118.932] GetFileType (hFile=0x15c) returned 0x1 [0118.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0118.932] GetFileType (hFile=0x15c) returned 0x1 [0119.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFilePart=0x0) returned 0x7b [0119.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0119.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x228 [0119.375] GetFileType (hFile=0x228) returned 0x1 [0119.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0119.375] GetFileType (hFile=0x228) returned 0x1 [0119.375] ReadFile (in: hFile=0x228, lpBuffer=0x23b2858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23b2858*, lpNumberOfBytesRead=0x2edd68*=0x5a7, lpOverlapped=0x0) returned 1 [0119.395] ReadFile (in: hFile=0x228, lpBuffer=0x23b25e7, nNumberOfBytesToRead=0x259, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23b25e7*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0119.396] ReadFile (in: hFile=0x228, lpBuffer=0x23b2858, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23b2858*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0119.396] CloseHandle (hObject=0x228) returned 1 [0119.396] WriteFile (in: hFile=0x15c, lpBuffer=0x23b0cc0*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x23b0cc0*, lpNumberOfBytesWritten=0x2edc38*=0x5d0, lpOverlapped=0x0) returned 1 [0119.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk", lpFilePart=0x0) returned 0x7b [0119.397] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\launch internet explorer browser.lnk")) returned 1 [0119.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x68 [0119.398] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", dwFileAttributes=0x80) returned 1 [0119.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.Horsuke", lpFilePart=0x0) returned 0x70 [0119.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0119.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0119.400] GetFileType (hFile=0x15c) returned 0x1 [0119.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0119.400] GetFileType (hFile=0x15c) returned 0x1 [0119.858] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x68 [0119.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0119.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0119.858] GetFileType (hFile=0x23c) returned 0x1 [0119.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0119.858] GetFileType (hFile=0x23c) returned 0x1 [0119.858] ReadFile (in: hFile=0x23c, lpBuffer=0x229b940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x229b940*, lpNumberOfBytesRead=0x2edd68*=0x122, lpOverlapped=0x0) returned 1 [0119.859] ReadFile (in: hFile=0x23c, lpBuffer=0x229b940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x229b940*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0119.860] CloseHandle (hObject=0x23c) returned 1 [0119.860] WriteFile (in: hFile=0x15c, lpBuffer=0x2299df0*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x2299df0*, lpNumberOfBytesWritten=0x2edc38*=0x150, lpOverlapped=0x0) returned 1 [0119.860] CloseHandle (hObject=0x15c) returned 1 [0119.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk", lpFilePart=0x0) returned 0x68 [0119.861] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\shows desktop.lnk")) returned 1 [0119.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x6a [0119.861] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", dwFileAttributes=0x80) returned 1 [0119.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.Horsuke", lpFilePart=0x0) returned 0x72 [0119.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0119.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0119.864] GetFileType (hFile=0x15c) returned 0x1 [0119.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0119.864] GetFileType (hFile=0x15c) returned 0x1 [0120.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x6a [0120.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0120.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0120.351] GetFileType (hFile=0x23c) returned 0x1 [0120.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0120.351] GetFileType (hFile=0x23c) returned 0x1 [0120.351] ReadFile (in: hFile=0x23c, lpBuffer=0x23844c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23844c8*, lpNumberOfBytesRead=0x2edd68*=0x110, lpOverlapped=0x0) returned 1 [0120.352] ReadFile (in: hFile=0x23c, lpBuffer=0x23844c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23844c8*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0120.352] CloseHandle (hObject=0x23c) returned 1 [0120.352] WriteFile (in: hFile=0x15c, lpBuffer=0x2382978*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x2382978*, lpNumberOfBytesWritten=0x2edc38*=0x140, lpOverlapped=0x0) returned 1 [0120.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk", lpFilePart=0x0) returned 0x6a [0120.353] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\window switcher.lnk")) returned 1 [0120.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0120.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0120.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63 [0120.354] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0120.354] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0120.354] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0120.354] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0120.354] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0120.354] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0120.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0120.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0120.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0120.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned", lpFilePart=0x0) returned 0x62 [0120.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\", lpFilePart=0x0) returned 0x63 [0120.355] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0120.355] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0120.355] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0120.355] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0120.355] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0120.355] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0120.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0120.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0120.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0120.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77 [0120.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x78 [0120.355] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0120.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0120.356] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0120.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0120.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0120.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0120.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts", lpFilePart=0x0) returned 0x77 [0120.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\", lpFilePart=0x0) returned 0x78 [0120.356] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0120.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0120.357] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0120.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0120.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0120.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.TXT", lpFilePart=0x0) returned 0x80 [0120.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0120.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0120.360] GetFileType (hFile=0x15c) returned 0x1 [0120.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0120.360] GetFileType (hFile=0x15c) returned 0x1 [0120.361] WriteFile (in: hFile=0x15c, lpBuffer=0x23947d0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x23947d0*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0120.362] CloseHandle (hObject=0x15c) returned 1 [0120.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.png", lpFilePart=0x0) returned 0x80 [0120.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0120.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0120.363] GetFileType (hFile=0x15c) returned 0x1 [0120.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0120.364] GetFileType (hFile=0x15c) returned 0x1 [0120.364] WriteFile (in: hFile=0x15c, lpBuffer=0x2395908*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x2395908*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0120.364] CloseHandle (hObject=0x15c) returned 1 [0120.365] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.vbs", lpFilePart=0x0) returned 0x80 [0120.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0120.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0120.366] GetFileType (hFile=0x15c) returned 0x1 [0120.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0120.366] GetFileType (hFile=0x15c) returned 0x1 [0120.366] WriteFile (in: hFile=0x15c, lpBuffer=0x2399628*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2399628*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0120.367] CloseHandle (hObject=0x15c) returned 1 [0120.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xac [0120.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0120.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\ImplicitAppShortcuts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\implicitappshortcuts\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0120.375] GetFileType (hFile=0x15c) returned 0x1 [0120.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0120.375] GetFileType (hFile=0x15c) returned 0x1 [0120.375] WriteFile (in: hFile=0x15c, lpBuffer=0x239c138*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x239c138*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0120.376] CloseHandle (hObject=0x15c) returned 1 [0120.376] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0120.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a [0120.376] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x6b [0120.376] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.377] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.378] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.378] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.378] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0120.378] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0120.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0120.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0120.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0120.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar", lpFilePart=0x0) returned 0x6a [0120.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\", lpFilePart=0x0) returned 0x6b [0120.378] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0120.378] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.378] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.379] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0120.380] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0120.380] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0120.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0120.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0120.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFilePart=0x0) returned 0x7c [0120.380] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", dwFileAttributes=0x80) returned 1 [0120.381] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.Horsuke", lpFilePart=0x0) returned 0x84 [0120.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0120.381] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0120.382] GetFileType (hFile=0x15c) returned 0x1 [0120.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0120.382] GetFileType (hFile=0x15c) returned 0x1 [0120.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFilePart=0x0) returned 0x7c [0120.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0120.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0120.833] GetFileType (hFile=0x23c) returned 0x1 [0120.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0120.834] GetFileType (hFile=0x23c) returned 0x1 [0120.834] ReadFile (in: hFile=0x23c, lpBuffer=0x228b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x228b7f0*, lpNumberOfBytesRead=0x2edc68*=0x8dd, lpOverlapped=0x0) returned 1 [0120.836] ReadFile (in: hFile=0x23c, lpBuffer=0x228b4b5, nNumberOfBytesToRead=0x323, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x228b4b5*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0120.837] ReadFile (in: hFile=0x23c, lpBuffer=0x228b7f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x228b7f0*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0120.837] CloseHandle (hObject=0x23c) returned 1 [0120.837] WriteFile (in: hFile=0x15c, lpBuffer=0x2289c78*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2289c78*, lpNumberOfBytesWritten=0x2edb38*=0x900, lpOverlapped=0x0) returned 1 [0120.838] CloseHandle (hObject=0x15c) returned 1 [0120.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk", lpFilePart=0x0) returned 0x7c [0120.838] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Google Chrome.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\google chrome.lnk")) returned 1 [0120.840] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFilePart=0x0) returned 0x84 [0120.840] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", dwFileAttributes=0x80) returned 1 [0120.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.Horsuke", lpFilePart=0x0) returned 0x8c [0120.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0120.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0120.842] GetFileType (hFile=0x15c) returned 0x1 [0120.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0120.842] GetFileType (hFile=0x15c) returned 0x1 [0121.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFilePart=0x0) returned 0x84 [0121.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0121.287] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0121.288] GetFileType (hFile=0x23c) returned 0x1 [0121.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0121.288] GetFileType (hFile=0x23c) returned 0x1 [0121.288] ReadFile (in: hFile=0x23c, lpBuffer=0x23743b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23743b8*, lpNumberOfBytesRead=0x2edc68*=0x5ad, lpOverlapped=0x0) returned 1 [0121.289] ReadFile (in: hFile=0x23c, lpBuffer=0x237414d, nNumberOfBytesToRead=0x253, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x237414d*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0121.290] ReadFile (in: hFile=0x23c, lpBuffer=0x23743b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23743b8*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0121.290] CloseHandle (hObject=0x23c) returned 1 [0121.290] WriteFile (in: hFile=0x15c, lpBuffer=0x2372820*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2372820*, lpNumberOfBytesWritten=0x2edb38*=0x5d0, lpOverlapped=0x0) returned 1 [0121.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk", lpFilePart=0x0) returned 0x84 [0121.291] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer (2).lnk")) returned 1 [0121.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x80 [0121.292] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", dwFileAttributes=0x80) returned 1 [0121.299] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.Horsuke", lpFilePart=0x0) returned 0x88 [0121.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0121.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0121.301] GetFileType (hFile=0x15c) returned 0x1 [0121.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0121.301] GetFileType (hFile=0x15c) returned 0x1 [0121.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x80 [0121.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0121.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0121.751] GetFileType (hFile=0x23c) returned 0x1 [0121.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0121.751] GetFileType (hFile=0x23c) returned 0x1 [0121.751] ReadFile (in: hFile=0x23c, lpBuffer=0x225b5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x225b5b0*, lpNumberOfBytesRead=0x2edc68*=0x5a9, lpOverlapped=0x0) returned 1 [0121.753] ReadFile (in: hFile=0x23c, lpBuffer=0x225b341, nNumberOfBytesToRead=0x257, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x225b341*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0121.754] ReadFile (in: hFile=0x23c, lpBuffer=0x225b5b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x225b5b0*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0121.754] CloseHandle (hObject=0x23c) returned 1 [0121.754] WriteFile (in: hFile=0x15c, lpBuffer=0x2259a28*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2259a28*, lpNumberOfBytesWritten=0x2edb38*=0x5d0, lpOverlapped=0x0) returned 1 [0121.755] CloseHandle (hObject=0x15c) returned 1 [0121.755] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk", lpFilePart=0x0) returned 0x80 [0121.755] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\internet explorer.lnk")) returned 1 [0121.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x7e [0121.756] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", dwFileAttributes=0x80) returned 1 [0121.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.Horsuke", lpFilePart=0x0) returned 0x86 [0121.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0121.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0121.758] GetFileType (hFile=0x15c) returned 0x1 [0121.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0121.758] GetFileType (hFile=0x15c) returned 0x1 [0122.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x7e [0122.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0122.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0122.288] GetFileType (hFile=0x23c) returned 0x1 [0122.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0122.288] GetFileType (hFile=0x23c) returned 0x1 [0122.289] ReadFile (in: hFile=0x23c, lpBuffer=0x23427b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23427b8*, lpNumberOfBytesRead=0x2edc68*=0x491, lpOverlapped=0x0) returned 1 [0122.290] ReadFile (in: hFile=0x23c, lpBuffer=0x2342431, nNumberOfBytesToRead=0x36f, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2342431*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0122.290] ReadFile (in: hFile=0x23c, lpBuffer=0x23427b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23427b8*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0122.290] CloseHandle (hObject=0x23c) returned 1 [0122.290] WriteFile (in: hFile=0x15c, lpBuffer=0x2340c40*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2340c40*, lpNumberOfBytesWritten=0x2edb38*=0x4c0, lpOverlapped=0x0) returned 1 [0122.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk", lpFilePart=0x0) returned 0x7e [0122.291] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Mozilla Firefox.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\mozilla firefox.lnk")) returned 1 [0122.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFilePart=0x0) returned 0x83 [0122.293] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", dwFileAttributes=0x80) returned 1 [0122.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.Horsuke", lpFilePart=0x0) returned 0x8b [0122.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0122.293] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0122.294] GetFileType (hFile=0x15c) returned 0x1 [0122.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0122.294] GetFileType (hFile=0x15c) returned 0x1 [0122.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFilePart=0x0) returned 0x83 [0122.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0122.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0122.753] GetFileType (hFile=0x23c) returned 0x1 [0122.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0122.753] GetFileType (hFile=0x23c) returned 0x1 [0122.753] ReadFile (in: hFile=0x23c, lpBuffer=0x24298e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x24298e8*, lpNumberOfBytesRead=0x2edc68*=0x4cc, lpOverlapped=0x0) returned 1 [0122.754] ReadFile (in: hFile=0x23c, lpBuffer=0x242959c, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x242959c*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0122.755] ReadFile (in: hFile=0x23c, lpBuffer=0x24298e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x24298e8*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0122.755] CloseHandle (hObject=0x23c) returned 1 [0122.755] WriteFile (in: hFile=0x15c, lpBuffer=0x2427d58*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x2427d58*, lpNumberOfBytesWritten=0x2edb38*=0x4f0, lpOverlapped=0x0) returned 1 [0122.756] CloseHandle (hObject=0x15c) returned 1 [0122.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk", lpFilePart=0x0) returned 0x83 [0122.757] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer (2).lnk")) returned 1 [0122.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x7f [0122.758] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", dwFileAttributes=0x80) returned 1 [0122.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.Horsuke", lpFilePart=0x0) returned 0x87 [0122.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0122.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0122.762] GetFileType (hFile=0x15c) returned 0x1 [0122.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0122.762] GetFileType (hFile=0x15c) returned 0x1 [0123.203] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x7f [0123.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0123.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0123.204] GetFileType (hFile=0x23c) returned 0x1 [0123.204] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0123.204] GetFileType (hFile=0x23c) returned 0x1 [0123.204] ReadFile (in: hFile=0x23c, lpBuffer=0x23109d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23109d0*, lpNumberOfBytesRead=0x2edc68*=0x4cc, lpOverlapped=0x0) returned 1 [0123.207] ReadFile (in: hFile=0x23c, lpBuffer=0x2310684, nNumberOfBytesToRead=0x334, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x2310684*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0123.207] ReadFile (in: hFile=0x23c, lpBuffer=0x23109d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23109d0*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0123.207] CloseHandle (hObject=0x23c) returned 1 [0123.207] WriteFile (in: hFile=0x15c, lpBuffer=0x230ee50*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x230ee50*, lpNumberOfBytesWritten=0x2edb38*=0x4f0, lpOverlapped=0x0) returned 1 [0123.208] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk", lpFilePart=0x0) returned 0x7f [0123.208] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows explorer.lnk")) returned 1 [0123.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFilePart=0x0) returned 0x87 [0123.209] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", dwFileAttributes=0x80) returned 1 [0123.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.Horsuke", lpFilePart=0x0) returned 0x8f [0123.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0123.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0123.211] GetFileType (hFile=0x15c) returned 0x1 [0123.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0123.211] GetFileType (hFile=0x15c) returned 0x1 [0123.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFilePart=0x0) returned 0x87 [0123.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0123.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0123.698] GetFileType (hFile=0x23c) returned 0x1 [0123.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0123.698] GetFileType (hFile=0x23c) returned 0x1 [0123.698] ReadFile (in: hFile=0x23c, lpBuffer=0x23d99a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23d99a0*, lpNumberOfBytesRead=0x2edc68*=0x60b, lpOverlapped=0x0) returned 1 [0123.699] ReadFile (in: hFile=0x23c, lpBuffer=0x23d9793, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23d9793*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0123.700] ReadFile (in: hFile=0x23c, lpBuffer=0x23d99a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x23d99a0*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0123.700] CloseHandle (hObject=0x23c) returned 1 [0123.700] WriteFile (in: hFile=0x15c, lpBuffer=0x23d7e00*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x23d7e00*, lpNumberOfBytesWritten=0x2edb38*=0x630, lpOverlapped=0x0) returned 1 [0123.701] CloseHandle (hObject=0x15c) returned 1 [0123.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk", lpFilePart=0x0) returned 0x87 [0123.701] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player (2).lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player (2).lnk")) returned 1 [0123.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x83 [0123.703] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", dwFileAttributes=0x80) returned 1 [0123.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.Horsuke", lpFilePart=0x0) returned 0x8b [0123.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0123.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0123.705] GetFileType (hFile=0x15c) returned 0x1 [0123.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0123.705] GetFileType (hFile=0x15c) returned 0x1 [0124.191] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2ed650, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x83 [0124.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb30) returned 1 [0124.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0124.192] GetFileType (hFile=0x23c) returned 0x1 [0124.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0124.192] GetFileType (hFile=0x23c) returned 0x1 [0124.192] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x22c2c10*, lpNumberOfBytesRead=0x2edc68*=0x60b, lpOverlapped=0x0) returned 1 [0124.203] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2a03, nNumberOfBytesToRead=0x1f5, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x22c2a03*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0124.204] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edc68, lpOverlapped=0x0 | out: lpBuffer=0x22c2c10*, lpNumberOfBytesRead=0x2edc68*=0x0, lpOverlapped=0x0) returned 1 [0124.204] CloseHandle (hObject=0x23c) returned 1 [0124.204] WriteFile (in: hFile=0x15c, lpBuffer=0x22c1080*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x22c1080*, lpNumberOfBytesWritten=0x2edb38*=0x630, lpOverlapped=0x0) returned 1 [0124.205] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", nBufferLength=0x105, lpBuffer=0x2ed760, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk", lpFilePart=0x0) returned 0x83 [0124.205] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Media Player.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\windows media player.lnk")) returned 1 [0124.207] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.TXT", lpFilePart=0x0) returned 0x73 [0124.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.207] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.208] GetFileType (hFile=0x15c) returned 0x1 [0124.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.208] GetFileType (hFile=0x15c) returned 0x1 [0124.209] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.png", lpFilePart=0x0) returned 0x73 [0124.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0124.209] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.210] GetFileType (hFile=0x15c) returned 0x1 [0124.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0124.210] GetFileType (hFile=0x15c) returned 0x1 [0124.210] WriteFile (in: hFile=0x15c, lpBuffer=0x22ce8a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22ce8a0*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.210] CloseHandle (hObject=0x15c) returned 1 [0124.211] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.vbs", lpFilePart=0x0) returned 0x73 [0124.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.211] GetFileType (hFile=0x15c) returned 0x1 [0124.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.211] GetFileType (hFile=0x15c) returned 0x1 [0124.212] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9f [0124.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\taskbar\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.213] GetFileType (hFile=0x15c) returned 0x1 [0124.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.213] GetFileType (hFile=0x15c) returned 0x1 [0124.214] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.TXT", lpFilePart=0x0) returned 0x6b [0124.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.215] GetFileType (hFile=0x15c) returned 0x1 [0124.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.215] GetFileType (hFile=0x15c) returned 0x1 [0124.215] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.png", lpFilePart=0x0) returned 0x6b [0124.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0124.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.216] GetFileType (hFile=0x15c) returned 0x1 [0124.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0124.216] GetFileType (hFile=0x15c) returned 0x1 [0124.216] WriteFile (in: hFile=0x15c, lpBuffer=0x22e04d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22e04d0*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0124.217] CloseHandle (hObject=0x15c) returned 1 [0124.217] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.vbs", lpFilePart=0x0) returned 0x6b [0124.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.217] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.219] GetFileType (hFile=0x15c) returned 0x1 [0124.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.220] GetFileType (hFile=0x15c) returned 0x1 [0124.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x97 [0124.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\user pinned\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.221] GetFileType (hFile=0x15c) returned 0x1 [0124.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.221] GetFileType (hFile=0x15c) returned 0x1 [0124.222] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.TXT", lpFilePart=0x0) returned 0x5f [0124.222] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.223] GetFileType (hFile=0x15c) returned 0x1 [0124.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.223] GetFileType (hFile=0x15c) returned 0x1 [0124.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.png", lpFilePart=0x0) returned 0x5f [0124.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.224] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.224] GetFileType (hFile=0x15c) returned 0x1 [0124.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.224] GetFileType (hFile=0x15c) returned 0x1 [0124.224] WriteFile (in: hFile=0x15c, lpBuffer=0x22f2068*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22f2068*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.225] CloseHandle (hObject=0x15c) returned 1 [0124.225] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.vbs", lpFilePart=0x0) returned 0x5f [0124.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.226] GetFileType (hFile=0x15c) returned 0x1 [0124.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.226] GetFileType (hFile=0x15c) returned 0x1 [0124.226] WriteFile (in: hFile=0x15c, lpBuffer=0x22f5cb0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x22f5cb0*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0124.227] CloseHandle (hObject=0x15c) returned 1 [0124.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8b [0124.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Quick Launch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\quick launch\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.227] GetFileType (hFile=0x15c) returned 0x1 [0124.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.228] GetFileType (hFile=0x15c) returned 0x1 [0124.228] WriteFile (in: hFile=0x15c, lpBuffer=0x22f8730*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x22f8730*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0124.228] CloseHandle (hObject=0x15c) returned 1 [0124.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0124.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x53 [0124.229] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.230] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.230] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.230] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.230] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData", lpFilePart=0x0) returned 0x52 [0124.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\", lpFilePart=0x0) returned 0x53 [0124.230] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.230] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.231] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.231] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.231] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0124.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x57 [0124.231] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0124.231] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.231] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.231] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.232] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.232] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.232] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.232] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0124.232] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0124.232] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low", lpFilePart=0x0) returned 0x56 [0124.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\", lpFilePart=0x0) returned 0x57 [0124.232] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0124.232] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0124.233] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0124.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f [0124.233] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", lpFilePart=0x0) returned 0x60 [0124.233] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.234] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0", lpFilePart=0x0) returned 0x5f [0124.234] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\", lpFilePart=0x0) returned 0x60 [0124.234] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.235] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.235] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.237] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.TXT", lpFilePart=0x0) returned 0x68 [0124.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.238] GetFileType (hFile=0x15c) returned 0x1 [0124.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.238] GetFileType (hFile=0x15c) returned 0x1 [0124.238] WriteFile (in: hFile=0x15c, lpBuffer=0x230b3d8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x230b3d8*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0124.239] CloseHandle (hObject=0x15c) returned 1 [0124.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.png", lpFilePart=0x0) returned 0x68 [0124.239] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0124.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.240] GetFileType (hFile=0x15c) returned 0x1 [0124.240] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0124.240] GetFileType (hFile=0x15c) returned 0x1 [0124.240] WriteFile (in: hFile=0x15c, lpBuffer=0x230c4e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x230c4e0*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.241] CloseHandle (hObject=0x15c) returned 1 [0124.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.vbs", lpFilePart=0x0) returned 0x68 [0124.241] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.241] GetFileType (hFile=0x15c) returned 0x1 [0124.241] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.241] GetFileType (hFile=0x15c) returned 0x1 [0124.241] WriteFile (in: hFile=0x15c, lpBuffer=0x2310170*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2310170*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0124.242] CloseHandle (hObject=0x15c) returned 1 [0124.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x94 [0124.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\65UX3YG0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\65ux3yg0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.242] GetFileType (hFile=0x15c) returned 0x1 [0124.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.242] GetFileType (hFile=0x15c) returned 0x1 [0124.243] WriteFile (in: hFile=0x15c, lpBuffer=0x2312c20*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2312c20*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0124.243] CloseHandle (hObject=0x15c) returned 1 [0124.243] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f [0124.243] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", lpFilePart=0x0) returned 0x60 [0124.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.244] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.244] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.244] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.244] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.244] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR", lpFilePart=0x0) returned 0x5f [0124.244] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\", lpFilePart=0x0) returned 0x60 [0124.244] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.244] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.245] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.245] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.245] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.246] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.TXT", lpFilePart=0x0) returned 0x68 [0124.246] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.246] GetFileType (hFile=0x15c) returned 0x1 [0124.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.246] GetFileType (hFile=0x15c) returned 0x1 [0124.246] WriteFile (in: hFile=0x15c, lpBuffer=0x231f5e8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x231f5e8*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0124.247] CloseHandle (hObject=0x15c) returned 1 [0124.247] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.png", lpFilePart=0x0) returned 0x68 [0124.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0124.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.248] GetFileType (hFile=0x15c) returned 0x1 [0124.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0124.248] GetFileType (hFile=0x15c) returned 0x1 [0124.248] WriteFile (in: hFile=0x15c, lpBuffer=0x23206f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x23206f0*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.249] CloseHandle (hObject=0x15c) returned 1 [0124.249] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.vbs", lpFilePart=0x0) returned 0x68 [0124.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.249] GetFileType (hFile=0x15c) returned 0x1 [0124.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.249] GetFileType (hFile=0x15c) returned 0x1 [0124.249] WriteFile (in: hFile=0x15c, lpBuffer=0x2324380*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2324380*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0124.250] CloseHandle (hObject=0x15c) returned 1 [0124.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x94 [0124.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\AY721QDR\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\ay721qdr\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.250] GetFileType (hFile=0x15c) returned 0x1 [0124.250] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.251] GetFileType (hFile=0x15c) returned 0x1 [0124.251] WriteFile (in: hFile=0x15c, lpBuffer=0x2326e30*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2326e30*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0124.251] CloseHandle (hObject=0x15c) returned 1 [0124.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f [0124.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", lpFilePart=0x0) returned 0x60 [0124.252] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.252] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.252] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.252] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC", lpFilePart=0x0) returned 0x5f [0124.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\", lpFilePart=0x0) returned 0x60 [0124.253] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.253] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.253] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.253] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.TXT", lpFilePart=0x0) returned 0x68 [0124.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.254] GetFileType (hFile=0x15c) returned 0x1 [0124.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.254] GetFileType (hFile=0x15c) returned 0x1 [0124.254] WriteFile (in: hFile=0x15c, lpBuffer=0x23337f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x23337f8*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0124.255] CloseHandle (hObject=0x15c) returned 1 [0124.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.png", lpFilePart=0x0) returned 0x68 [0124.255] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0124.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.256] GetFileType (hFile=0x15c) returned 0x1 [0124.256] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0124.256] GetFileType (hFile=0x15c) returned 0x1 [0124.256] WriteFile (in: hFile=0x15c, lpBuffer=0x2334900*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x2334900*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.257] CloseHandle (hObject=0x15c) returned 1 [0124.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.vbs", lpFilePart=0x0) returned 0x68 [0124.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.257] GetFileType (hFile=0x15c) returned 0x1 [0124.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.257] GetFileType (hFile=0x15c) returned 0x1 [0124.258] WriteFile (in: hFile=0x15c, lpBuffer=0x2338590*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2338590*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0124.258] CloseHandle (hObject=0x15c) returned 1 [0124.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x94 [0124.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\DZBKZBIC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\dzbkzbic\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.259] GetFileType (hFile=0x15c) returned 0x1 [0124.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.259] GetFileType (hFile=0x15c) returned 0x1 [0124.259] WriteFile (in: hFile=0x15c, lpBuffer=0x233b040*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x233b040*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0124.260] CloseHandle (hObject=0x15c) returned 1 [0124.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f [0124.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", lpFilePart=0x0) returned 0x60 [0124.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.260] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.260] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.260] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.260] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E", lpFilePart=0x0) returned 0x5f [0124.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\", lpFilePart=0x0) returned 0x60 [0124.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.261] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.261] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.261] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.TXT", lpFilePart=0x0) returned 0x68 [0124.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.png", lpFilePart=0x0) returned 0x68 [0124.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0124.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0124.264] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.vbs", lpFilePart=0x0) returned 0x68 [0124.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.264] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.265] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x94 [0124.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\VRLZOZ0E\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\vrlzoz0e\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.TXT", lpFilePart=0x0) returned 0x5f [0124.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.267] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.png", lpFilePart=0x0) returned 0x5f [0124.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0124.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0124.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.vbs", lpFilePart=0x0) returned 0x5f [0124.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8b [0124.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Low\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\low\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0124.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.273] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.274] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.png", lpFilePart=0x0) returned 0x5b [0124.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0124.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.275] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0124.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UserData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\userdata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.279] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0124.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.280] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.png", lpFilePart=0x0) returned 0x52 [0124.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.281] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0124.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.284] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0124.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Internet Explorer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\internet explorer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0124.286] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x3c [0124.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.287] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.287] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.287] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.287] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC", lpFilePart=0x0) returned 0x3b [0124.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\", lpFilePart=0x0) returned 0x3c [0124.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.288] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.288] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.288] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.TXT", lpFilePart=0x0) returned 0x44 [0124.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.png", lpFilePart=0x0) returned 0x44 [0124.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.292] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.vbs", lpFilePart=0x0) returned 0x44 [0124.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x70 [0124.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MMC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\mmc\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0124.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", lpFilePart=0x0) returned 0x43 [0124.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.296] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.296] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.296] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.296] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project", lpFilePart=0x0) returned 0x42 [0124.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\", lpFilePart=0x0) returned 0x43 [0124.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.297] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.297] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.297] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.297] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45 [0124.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", lpFilePart=0x0) returned 0x46 [0124.297] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.304] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.304] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.304] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.305] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14", lpFilePart=0x0) returned 0x45 [0124.305] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\", lpFilePart=0x0) returned 0x46 [0124.305] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.305] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.305] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.305] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.305] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.305] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.305] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a [0124.306] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", lpFilePart=0x0) returned 0x4b [0124.306] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0124.307] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.307] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.307] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0124.307] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0124.307] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.307] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.307] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033", lpFilePart=0x0) returned 0x4a [0124.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\", lpFilePart=0x0) returned 0x4b [0124.308] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0124.308] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.308] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.308] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0124.308] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0124.308] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.308] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0124.309] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.310] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.png", lpFilePart=0x0) returned 0x53 [0124.310] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0124.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.311] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0124.312] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0124.312] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.312] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.313] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0124.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\1033\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\1033\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.TXT", lpFilePart=0x0) returned 0x4e [0124.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.316] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.317] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.png", lpFilePart=0x0) returned 0x4e [0124.317] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.318] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.vbs", lpFilePart=0x0) returned 0x4e [0124.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.319] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7a [0124.319] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\14\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\14\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.TXT", lpFilePart=0x0) returned 0x4b [0124.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.326] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.png", lpFilePart=0x0) returned 0x4b [0124.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.vbs", lpFilePart=0x0) returned 0x4b [0124.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x77 [0124.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\MS Project\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\ms project\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f [0124.332] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x40 [0124.333] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.333] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.333] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.333] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.333] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network", lpFilePart=0x0) returned 0x3f [0124.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x40 [0124.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.334] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.334] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.334] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.334] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b [0124.334] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x4c [0124.334] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.335] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.335] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.335] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.335] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x4b [0124.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x4c [0124.335] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.335] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.336] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.336] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.336] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f [0124.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpFilePart=0x0) returned 0x50 [0124.336] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0124.336] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.336] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.337] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0124.337] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0124.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk", lpFilePart=0x0) returned 0x4f [0124.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\", lpFilePart=0x0) returned 0x50 [0124.337] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0124.337] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.337] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0124.337] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0124.337] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0124.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a [0124.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpFilePart=0x0) returned 0x5b [0124.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.338] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.338] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.338] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.338] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk", lpFilePart=0x0) returned 0x5a [0124.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\", lpFilePart=0x0) returned 0x5b [0124.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0124.339] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.339] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0124.339] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0124.339] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0124.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0124.339] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.TXT", lpFilePart=0x0) returned 0x63 [0124.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.png", lpFilePart=0x0) returned 0x63 [0124.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0124.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0124.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.vbs", lpFilePart=0x0) returned 0x63 [0124.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.343] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8f [0124.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0124.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\_hiddenPbk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\_hiddenpbk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0124.346] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.TXT", lpFilePart=0x0) returned 0x58 [0124.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.png", lpFilePart=0x0) returned 0x58 [0124.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0124.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0124.349] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.vbs", lpFilePart=0x0) returned 0x58 [0124.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x84 [0124.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0124.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Pbk\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\pbk\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0124.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.TXT", lpFilePart=0x0) returned 0x54 [0124.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.354] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.png", lpFilePart=0x0) returned 0x54 [0124.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.vbs", lpFilePart=0x0) returned 0x54 [0124.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.357] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x80 [0124.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\connections\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0124.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.359] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.png", lpFilePart=0x0) returned 0x48 [0124.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0124.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.363] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0124.363] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\network\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e [0124.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3f [0124.366] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.390] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.390] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office", lpFilePart=0x0) returned 0x3e [0124.390] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\", lpFilePart=0x0) returned 0x3f [0124.390] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.391] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.391] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.391] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45 [0124.391] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpFilePart=0x0) returned 0x46 [0124.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.392] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent", lpFilePart=0x0) returned 0x45 [0124.392] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\", lpFilePart=0x0) returned 0x46 [0124.392] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.392] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.393] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.393] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.393] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.393] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.396] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.TXT", lpFilePart=0x0) returned 0x4e [0124.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.401] WriteFile (in: hFile=0x15c, lpBuffer=0x2234b40*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2234b40*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0124.402] CloseHandle (hObject=0x15c) returned 1 [0124.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.png", lpFilePart=0x0) returned 0x4e [0124.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.403] GetFileType (hFile=0x15c) returned 0x1 [0124.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.403] GetFileType (hFile=0x15c) returned 0x1 [0124.403] WriteFile (in: hFile=0x15c, lpBuffer=0x2235c10*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2235c10*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.404] CloseHandle (hObject=0x15c) returned 1 [0124.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.vbs", lpFilePart=0x0) returned 0x4e [0124.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.406] GetFileType (hFile=0x15c) returned 0x1 [0124.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.406] GetFileType (hFile=0x15c) returned 0x1 [0124.406] WriteFile (in: hFile=0x15c, lpBuffer=0x22397f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x22397f8*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0124.407] CloseHandle (hObject=0x15c) returned 1 [0124.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7a [0124.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.407] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Recent\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\recent\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.408] GetFileType (hFile=0x15c) returned 0x1 [0124.408] WriteFile (in: hFile=0x15c, lpBuffer=0x223c238*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x223c238*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0124.414] CloseHandle (hObject=0x15c) returned 1 [0124.416] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0124.416] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.417] GetFileType (hFile=0x15c) returned 0x1 [0124.417] WriteFile (in: hFile=0x15c, lpBuffer=0x2246540*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2246540*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0124.418] CloseHandle (hObject=0x15c) returned 1 [0124.418] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.png", lpFilePart=0x0) returned 0x47 [0124.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.419] GetFileType (hFile=0x15c) returned 0x1 [0124.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0124.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.420] GetFileType (hFile=0x15c) returned 0x1 [0124.421] WriteFile (in: hFile=0x15c, lpBuffer=0x224b1b8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x224b1b8*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0124.421] CloseHandle (hObject=0x15c) returned 1 [0124.421] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0124.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Office\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\office\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.423] GetFileType (hFile=0x15c) returned 0x1 [0124.424] WriteFile (in: hFile=0x15c, lpBuffer=0x224dbd8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x224dbd8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0124.425] CloseHandle (hObject=0x15c) returned 1 [0124.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f [0124.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x40 [0124.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.426] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook", lpFilePart=0x0) returned 0x3f [0124.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\", lpFilePart=0x0) returned 0x40 [0124.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.427] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.427] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.427] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.427] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.427] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.427] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0124.427] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", dwFileAttributes=0x80) returned 1 [0124.428] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.Horsuke", lpFilePart=0x0) returned 0x53 [0124.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.429] GetFileType (hFile=0x15c) returned 0x1 [0124.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0124.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0124.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0124.882] GetFileType (hFile=0x23c) returned 0x1 [0124.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0124.883] GetFileType (hFile=0x23c) returned 0x1 [0124.883] ReadFile (in: hFile=0x23c, lpBuffer=0x2338230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2338230*, lpNumberOfBytesRead=0x2edde8*=0x9a2, lpOverlapped=0x0) returned 1 [0124.898] ReadFile (in: hFile=0x23c, lpBuffer=0x2337fba, nNumberOfBytesToRead=0x25e, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2337fba*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0124.898] ReadFile (in: hFile=0x23c, lpBuffer=0x2338230, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2338230*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0124.898] CloseHandle (hObject=0x23c) returned 1 [0124.899] WriteFile (in: hFile=0x15c, lpBuffer=0x2336730*, nNumberOfBytesToWrite=0x9d0, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x2336730*, lpNumberOfBytesWritten=0x2edcb8*=0x9d0, lpOverlapped=0x0) returned 1 [0124.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml", lpFilePart=0x0) returned 0x4b [0124.899] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Outlook.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\outlook.xml")) returned 1 [0124.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0124.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.903] GetFileType (hFile=0x15c) returned 0x1 [0124.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.903] GetFileType (hFile=0x15c) returned 0x1 [0124.903] WriteFile (in: hFile=0x15c, lpBuffer=0x2343058*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2343058*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0124.904] CloseHandle (hObject=0x15c) returned 1 [0124.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.png", lpFilePart=0x0) returned 0x48 [0124.904] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.905] GetFileType (hFile=0x15c) returned 0x1 [0124.905] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.905] GetFileType (hFile=0x15c) returned 0x1 [0124.905] WriteFile (in: hFile=0x15c, lpBuffer=0x2344120*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2344120*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0124.906] CloseHandle (hObject=0x15c) returned 1 [0124.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0124.906] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.906] GetFileType (hFile=0x15c) returned 0x1 [0124.906] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.906] GetFileType (hFile=0x15c) returned 0x1 [0124.906] WriteFile (in: hFile=0x15c, lpBuffer=0x2347cf0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x2347cf0*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0124.907] CloseHandle (hObject=0x15c) returned 1 [0124.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0124.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Outlook\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\outlook\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.923] GetFileType (hFile=0x15c) returned 0x1 [0124.923] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.923] GetFileType (hFile=0x15c) returned 0x1 [0124.923] WriteFile (in: hFile=0x15c, lpBuffer=0x234a720*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x234a720*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0124.924] CloseHandle (hObject=0x15c) returned 1 [0124.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42 [0124.924] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpFilePart=0x0) returned 0x43 [0124.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.925] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.925] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.926] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint", lpFilePart=0x0) returned 0x42 [0124.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\", lpFilePart=0x0) returned 0x43 [0124.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.926] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.926] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.926] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.928] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.TXT", lpFilePart=0x0) returned 0x4b [0124.928] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.929] GetFileType (hFile=0x15c) returned 0x1 [0124.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.929] GetFileType (hFile=0x15c) returned 0x1 [0124.929] WriteFile (in: hFile=0x15c, lpBuffer=0x2356a98*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2356a98*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0124.930] CloseHandle (hObject=0x15c) returned 1 [0124.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.png", lpFilePart=0x0) returned 0x4b [0124.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.930] GetFileType (hFile=0x15c) returned 0x1 [0124.930] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.930] GetFileType (hFile=0x15c) returned 0x1 [0124.930] WriteFile (in: hFile=0x15c, lpBuffer=0x2357b60*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2357b60*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0124.931] CloseHandle (hObject=0x15c) returned 1 [0124.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.vbs", lpFilePart=0x0) returned 0x4b [0124.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.931] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.932] GetFileType (hFile=0x15c) returned 0x1 [0124.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.932] GetFileType (hFile=0x15c) returned 0x1 [0124.932] WriteFile (in: hFile=0x15c, lpBuffer=0x235b730*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x235b730*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0124.933] CloseHandle (hObject=0x15c) returned 1 [0124.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x77 [0124.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\PowerPoint\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\powerpoint\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.935] GetFileType (hFile=0x15c) returned 0x1 [0124.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.935] GetFileType (hFile=0x15c) returned 0x1 [0124.935] WriteFile (in: hFile=0x15c, lpBuffer=0x235e160*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x235e160*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0124.936] CloseHandle (hObject=0x15c) returned 1 [0124.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d [0124.936] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", lpFilePart=0x0) returned 0x3e [0124.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.946] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.946] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.947] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof", lpFilePart=0x0) returned 0x3d [0124.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\", lpFilePart=0x0) returned 0x3e [0124.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.947] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.947] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.947] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.947] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.TXT", lpFilePart=0x0) returned 0x46 [0124.947] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.948] GetFileType (hFile=0x15c) returned 0x1 [0124.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.948] GetFileType (hFile=0x15c) returned 0x1 [0124.948] WriteFile (in: hFile=0x15c, lpBuffer=0x236a388*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x236a388*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0124.949] CloseHandle (hObject=0x15c) returned 1 [0124.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.png", lpFilePart=0x0) returned 0x46 [0124.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.950] GetFileType (hFile=0x15c) returned 0x1 [0124.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.950] GetFileType (hFile=0x15c) returned 0x1 [0124.950] WriteFile (in: hFile=0x15c, lpBuffer=0x236b448*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x236b448*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0124.951] CloseHandle (hObject=0x15c) returned 1 [0124.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.vbs", lpFilePart=0x0) returned 0x46 [0124.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.951] GetFileType (hFile=0x15c) returned 0x1 [0124.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.951] GetFileType (hFile=0x15c) returned 0x1 [0124.951] WriteFile (in: hFile=0x15c, lpBuffer=0x236f000*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x236f000*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0124.952] CloseHandle (hObject=0x15c) returned 1 [0124.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x72 [0124.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Proof\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\proof\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.952] GetFileType (hFile=0x15c) returned 0x1 [0124.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.953] GetFileType (hFile=0x15c) returned 0x1 [0124.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f [0124.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x40 [0124.953] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.954] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.954] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.954] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect", lpFilePart=0x0) returned 0x3f [0124.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\", lpFilePart=0x0) returned 0x40 [0124.954] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.955] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.955] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.955] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.955] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.955] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.955] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.955] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d [0124.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x6e [0124.956] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.964] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.964] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.964] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.964] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.964] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500", lpFilePart=0x0) returned 0x6d [0124.965] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\", lpFilePart=0x0) returned 0x6e [0124.965] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.966] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.966] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.966] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.966] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.966] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.967] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.TXT", lpFilePart=0x0) returned 0x76 [0124.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.968] GetFileType (hFile=0x15c) returned 0x1 [0124.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.968] GetFileType (hFile=0x15c) returned 0x1 [0124.969] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.png", lpFilePart=0x0) returned 0x76 [0124.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.969] GetFileType (hFile=0x15c) returned 0x1 [0124.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.969] GetFileType (hFile=0x15c) returned 0x1 [0124.969] WriteFile (in: hFile=0x15c, lpBuffer=0x23837f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x23837f0*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.970] CloseHandle (hObject=0x15c) returned 1 [0124.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.vbs", lpFilePart=0x0) returned 0x76 [0124.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.971] GetFileType (hFile=0x15c) returned 0x1 [0124.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.971] GetFileType (hFile=0x15c) returned 0x1 [0124.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa2 [0124.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3111613574-2524581245-2586426736-500\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3111613574-2524581245-2586426736-500\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.972] GetFileType (hFile=0x15c) returned 0x1 [0124.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.972] GetFileType (hFile=0x15c) returned 0x1 [0124.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e [0124.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x6f [0124.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.973] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.973] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.973] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.973] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.974] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.974] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0124.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000", lpFilePart=0x0) returned 0x6e [0124.974] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\", lpFilePart=0x0) returned 0x6f [0124.974] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0124.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0124.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0124.975] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0124.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0124.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT", lpFilePart=0x0) returned 0x77 [0124.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.976] GetFileType (hFile=0x15c) returned 0x1 [0124.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.976] GetFileType (hFile=0x15c) returned 0x1 [0124.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png", lpFilePart=0x0) returned 0x77 [0124.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0124.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.977] GetFileType (hFile=0x15c) returned 0x1 [0124.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0124.978] GetFileType (hFile=0x15c) returned 0x1 [0124.978] WriteFile (in: hFile=0x15c, lpBuffer=0x239a670*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x239a670*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0124.978] CloseHandle (hObject=0x15c) returned 1 [0124.978] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs", lpFilePart=0x0) returned 0x77 [0124.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.979] GetFileType (hFile=0x15c) returned 0x1 [0124.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.979] GetFileType (hFile=0x15c) returned 0x1 [0124.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa3 [0124.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0124.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-3388679973-3930757225-3770151564-1000\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\s-1-5-21-3388679973-3930757225-3770151564-1000\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.981] GetFileType (hFile=0x15c) returned 0x1 [0124.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0124.981] GetFileType (hFile=0x15c) returned 0x1 [0124.981] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.TXT", lpFilePart=0x0) returned 0x48 [0124.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.982] GetFileType (hFile=0x15c) returned 0x1 [0124.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.982] GetFileType (hFile=0x15c) returned 0x1 [0124.983] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.png", lpFilePart=0x0) returned 0x48 [0124.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.983] GetFileType (hFile=0x15c) returned 0x1 [0124.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.983] GetFileType (hFile=0x15c) returned 0x1 [0124.983] WriteFile (in: hFile=0x15c, lpBuffer=0x23ac208*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23ac208*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0124.984] CloseHandle (hObject=0x15c) returned 1 [0124.984] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.vbs", lpFilePart=0x0) returned 0x48 [0124.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.985] GetFileType (hFile=0x15c) returned 0x1 [0124.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.985] GetFileType (hFile=0x15c) returned 0x1 [0124.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x74 [0124.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Protect\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\protect\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.987] GetFileType (hFile=0x15c) returned 0x1 [0124.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.987] GetFileType (hFile=0x15c) returned 0x1 [0124.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41 [0124.987] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x42 [0124.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.989] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.989] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.989] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher", lpFilePart=0x0) returned 0x41 [0124.989] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\", lpFilePart=0x0) returned 0x42 [0124.989] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0124.989] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0124.989] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0124.989] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0124.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0124.989] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0124.990] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0124.990] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.991] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.png", lpFilePart=0x0) returned 0x4a [0124.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0124.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0124.991] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0124.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0124.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0124.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0124.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0124.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0124.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0124.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51 [0124.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpFilePart=0x0) returned 0x52 [0124.997] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.002] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.002] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.002] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.002] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks", lpFilePart=0x0) returned 0x51 [0125.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\", lpFilePart=0x0) returned 0x52 [0125.002] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.002] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.002] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.003] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.003] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.003] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0125.003] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", dwFileAttributes=0x80) returned 1 [0125.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.Horsuke", lpFilePart=0x0) returned 0x6a [0125.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0125.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.462] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0125.462] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0125.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0125.463] GetFileType (hFile=0x23c) returned 0x1 [0125.463] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.463] GetFileType (hFile=0x23c) returned 0x1 [0125.463] ReadFile (in: hFile=0x23c, lpBuffer=0x22b1ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22b1ba0*, lpNumberOfBytesRead=0x2edde8*=0xa8, lpOverlapped=0x0) returned 1 [0125.464] ReadFile (in: hFile=0x23c, lpBuffer=0x22b1ba0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22b1ba0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0125.464] CloseHandle (hObject=0x23c) returned 1 [0125.464] WriteFile (in: hFile=0x15c, lpBuffer=0x22b0060*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22b0060*, lpNumberOfBytesWritten=0x2edcb8*=0xd0, lpOverlapped=0x0) returned 1 [0125.465] CloseHandle (hObject=0x15c) returned 1 [0125.465] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml", lpFilePart=0x0) returned 0x62 [0125.465] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\ContentStore.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\contentstore.xml")) returned 1 [0125.468] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0125.468] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.468] GetFileType (hFile=0x15c) returned 0x1 [0125.468] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.469] GetFileType (hFile=0x15c) returned 0x1 [0125.469] WriteFile (in: hFile=0x15c, lpBuffer=0x22bc100*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22bc100*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0125.470] CloseHandle (hObject=0x15c) returned 1 [0125.470] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.png", lpFilePart=0x0) returned 0x5a [0125.470] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.472] GetFileType (hFile=0x15c) returned 0x1 [0125.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.472] GetFileType (hFile=0x15c) returned 0x1 [0125.472] WriteFile (in: hFile=0x15c, lpBuffer=0x22bd1e8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22bd1e8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0125.473] CloseHandle (hObject=0x15c) returned 1 [0125.473] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0125.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.473] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.474] GetFileType (hFile=0x15c) returned 0x1 [0125.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.474] GetFileType (hFile=0x15c) returned 0x1 [0125.475] WriteFile (in: hFile=0x15c, lpBuffer=0x22c0e18*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22c0e18*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0125.475] CloseHandle (hObject=0x15c) returned 1 [0125.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0125.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\publisher building blocks\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.476] GetFileType (hFile=0x15c) returned 0x1 [0125.476] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.476] GetFileType (hFile=0x15c) returned 0x1 [0125.476] WriteFile (in: hFile=0x15c, lpBuffer=0x22c3888*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22c3888*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0125.477] CloseHandle (hObject=0x15c) returned 1 [0125.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e [0125.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x3f [0125.477] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.477] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.477] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.477] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.478] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech", lpFilePart=0x0) returned 0x3e [0125.478] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\", lpFilePart=0x0) returned 0x3f [0125.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.478] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.478] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.478] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.478] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0125.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.479] GetFileType (hFile=0x15c) returned 0x1 [0125.479] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.479] GetFileType (hFile=0x15c) returned 0x1 [0125.480] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.png", lpFilePart=0x0) returned 0x47 [0125.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.480] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.481] GetFileType (hFile=0x15c) returned 0x1 [0125.481] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.481] GetFileType (hFile=0x15c) returned 0x1 [0125.481] WriteFile (in: hFile=0x15c, lpBuffer=0x22d0be0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22d0be0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0125.481] CloseHandle (hObject=0x15c) returned 1 [0125.482] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0125.482] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.482] GetFileType (hFile=0x15c) returned 0x1 [0125.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.482] GetFileType (hFile=0x15c) returned 0x1 [0125.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0125.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\speech\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.483] GetFileType (hFile=0x15c) returned 0x1 [0125.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.483] GetFileType (hFile=0x15c) returned 0x1 [0125.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a [0125.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x4b [0125.484] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.485] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates", lpFilePart=0x0) returned 0x4a [0125.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\", lpFilePart=0x0) returned 0x4b [0125.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.485] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d [0125.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x4e [0125.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.486] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My", lpFilePart=0x0) returned 0x4d [0125.487] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\", lpFilePart=0x0) returned 0x4e [0125.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.487] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.487] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.487] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.487] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.487] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.487] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a [0125.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x5b [0125.488] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.488] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.488] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.488] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates", lpFilePart=0x0) returned 0x5a [0125.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\", lpFilePart=0x0) returned 0x5b [0125.488] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.489] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.489] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.TXT", lpFilePart=0x0) returned 0x63 [0125.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.490] GetFileType (hFile=0x15c) returned 0x1 [0125.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.490] GetFileType (hFile=0x15c) returned 0x1 [0125.491] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.png", lpFilePart=0x0) returned 0x63 [0125.491] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0125.491] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.491] GetFileType (hFile=0x15c) returned 0x1 [0125.491] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0125.491] GetFileType (hFile=0x15c) returned 0x1 [0125.491] WriteFile (in: hFile=0x15c, lpBuffer=0x22ea070*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22ea070*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0125.492] CloseHandle (hObject=0x15c) returned 1 [0125.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.vbs", lpFilePart=0x0) returned 0x63 [0125.492] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.492] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.492] GetFileType (hFile=0x15c) returned 0x1 [0125.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.492] GetFileType (hFile=0x15c) returned 0x1 [0125.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8f [0125.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\certificates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.497] GetFileType (hFile=0x15c) returned 0x1 [0125.497] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.497] GetFileType (hFile=0x15c) returned 0x1 [0125.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52 [0125.498] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x53 [0125.498] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.498] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.498] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.498] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.499] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs", lpFilePart=0x0) returned 0x52 [0125.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\", lpFilePart=0x0) returned 0x53 [0125.499] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.499] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.499] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.499] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0125.500] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.500] GetFileType (hFile=0x15c) returned 0x1 [0125.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.500] GetFileType (hFile=0x15c) returned 0x1 [0125.502] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.png", lpFilePart=0x0) returned 0x5b [0125.502] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0125.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.502] GetFileType (hFile=0x15c) returned 0x1 [0125.502] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0125.502] GetFileType (hFile=0x15c) returned 0x1 [0125.503] WriteFile (in: hFile=0x15c, lpBuffer=0x22fdf40*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22fdf40*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0125.503] CloseHandle (hObject=0x15c) returned 1 [0125.504] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0125.504] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.504] GetFileType (hFile=0x15c) returned 0x1 [0125.505] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.505] GetFileType (hFile=0x15c) returned 0x1 [0125.505] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0125.505] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\crls\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.506] GetFileType (hFile=0x15c) returned 0x1 [0125.506] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.506] GetFileType (hFile=0x15c) returned 0x1 [0125.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52 [0125.507] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x53 [0125.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.507] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.507] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.508] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs", lpFilePart=0x0) returned 0x52 [0125.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\", lpFilePart=0x0) returned 0x53 [0125.508] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.508] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.508] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.508] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.508] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.508] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0125.508] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.509] GetFileType (hFile=0x15c) returned 0x1 [0125.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.509] GetFileType (hFile=0x15c) returned 0x1 [0125.510] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.png", lpFilePart=0x0) returned 0x5b [0125.510] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0125.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.511] GetFileType (hFile=0x15c) returned 0x1 [0125.511] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0125.511] GetFileType (hFile=0x15c) returned 0x1 [0125.511] WriteFile (in: hFile=0x15c, lpBuffer=0x2311dc0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x2311dc0*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0125.512] CloseHandle (hObject=0x15c) returned 1 [0125.512] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0125.512] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.513] GetFileType (hFile=0x15c) returned 0x1 [0125.513] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.513] GetFileType (hFile=0x15c) returned 0x1 [0125.513] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0125.513] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0125.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\ctls\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.514] GetFileType (hFile=0x15c) returned 0x1 [0125.514] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0125.514] GetFileType (hFile=0x15c) returned 0x1 [0125.515] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.TXT", lpFilePart=0x0) returned 0x56 [0125.515] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.515] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.515] GetFileType (hFile=0x15c) returned 0x1 [0125.515] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.515] GetFileType (hFile=0x15c) returned 0x1 [0125.516] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.png", lpFilePart=0x0) returned 0x56 [0125.516] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0125.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.517] GetFileType (hFile=0x15c) returned 0x1 [0125.517] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0125.517] GetFileType (hFile=0x15c) returned 0x1 [0125.517] WriteFile (in: hFile=0x15c, lpBuffer=0x2323888*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2323888*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0125.518] CloseHandle (hObject=0x15c) returned 1 [0125.518] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.vbs", lpFilePart=0x0) returned 0x56 [0125.518] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.520] GetFileType (hFile=0x15c) returned 0x1 [0125.520] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.520] GetFileType (hFile=0x15c) returned 0x1 [0125.521] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x82 [0125.521] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\my\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.522] GetFileType (hFile=0x15c) returned 0x1 [0125.522] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.522] GetFileType (hFile=0x15c) returned 0x1 [0125.522] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0125.522] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.523] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.523] GetFileType (hFile=0x15c) returned 0x1 [0125.523] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.523] GetFileType (hFile=0x15c) returned 0x1 [0125.524] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.png", lpFilePart=0x0) returned 0x53 [0125.524] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.524] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.524] GetFileType (hFile=0x15c) returned 0x1 [0125.524] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.524] GetFileType (hFile=0x15c) returned 0x1 [0125.524] WriteFile (in: hFile=0x15c, lpBuffer=0x2335310*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2335310*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0125.525] CloseHandle (hObject=0x15c) returned 1 [0125.525] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0125.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.526] GetFileType (hFile=0x15c) returned 0x1 [0125.526] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.526] GetFileType (hFile=0x15c) returned 0x1 [0125.527] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0125.527] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\systemcertificates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.529] GetFileType (hFile=0x15c) returned 0x1 [0125.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.529] GetFileType (hFile=0x15c) returned 0x1 [0125.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41 [0125.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x42 [0125.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.531] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.531] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.531] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.531] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates", lpFilePart=0x0) returned 0x41 [0125.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\", lpFilePart=0x0) returned 0x42 [0125.532] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.532] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.532] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.532] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.532] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.TXT", lpFilePart=0x0) returned 0x4a [0125.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.png", lpFilePart=0x0) returned 0x4a [0125.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.vbs", lpFilePart=0x0) returned 0x4a [0125.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.549] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.550] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x76 [0125.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.550] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\templates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.551] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e [0125.551] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x3f [0125.551] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.552] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.552] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.552] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.553] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof", lpFilePart=0x0) returned 0x3e [0125.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\", lpFilePart=0x0) returned 0x3f [0125.553] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.553] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.553] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.553] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.553] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.553] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.553] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.TXT", lpFilePart=0x0) returned 0x47 [0125.553] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.554] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.555] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.png", lpFilePart=0x0) returned 0x47 [0125.555] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.556] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.vbs", lpFilePart=0x0) returned 0x47 [0125.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.556] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.557] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x73 [0125.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uproof\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c [0125.560] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x3d [0125.560] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.577] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.577] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word", lpFilePart=0x0) returned 0x3c [0125.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\", lpFilePart=0x0) returned 0x3d [0125.577] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.577] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.577] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.577] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.577] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44 [0125.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x45 [0125.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.579] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.579] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.579] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP", lpFilePart=0x0) returned 0x44 [0125.579] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\", lpFilePart=0x0) returned 0x45 [0125.579] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.579] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.579] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.580] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.580] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.TXT", lpFilePart=0x0) returned 0x4d [0125.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.581] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.581] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.png", lpFilePart=0x0) returned 0x4d [0125.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0125.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0125.583] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.vbs", lpFilePart=0x0) returned 0x4d [0125.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x79 [0125.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\STARTUP\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\startup\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.585] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.TXT", lpFilePart=0x0) returned 0x45 [0125.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.585] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.png", lpFilePart=0x0) returned 0x45 [0125.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.588] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.vbs", lpFilePart=0x0) returned 0x45 [0125.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x71 [0125.589] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Word\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\word\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.591] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.TXT", lpFilePart=0x0) returned 0x40 [0125.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0125.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0125.596] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x40 [0125.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.597] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0125.598] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.vbs", lpFilePart=0x0) returned 0x40 [0125.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0125.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0125.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6c [0125.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0125.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0125.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0125.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35 [0125.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x36 [0125.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0125.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0125.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0125.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0125.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0125.603] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0125.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0125.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0125.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla", lpFilePart=0x0) returned 0x35 [0125.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\", lpFilePart=0x0) returned 0x36 [0125.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0125.603] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0125.603] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0125.603] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0125.604] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0125.604] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0125.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0125.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40 [0125.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x41 [0125.604] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.605] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.605] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.605] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.605] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions", lpFilePart=0x0) returned 0x40 [0125.605] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\", lpFilePart=0x0) returned 0x41 [0125.605] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.606] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.606] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.606] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.606] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.TXT", lpFilePart=0x0) returned 0x49 [0125.606] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.607] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.png", lpFilePart=0x0) returned 0x49 [0125.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0125.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.vbs", lpFilePart=0x0) returned 0x49 [0125.609] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x75 [0125.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0125.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Extensions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\extensions\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0125.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0125.613] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3e [0125.613] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.614] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.614] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.614] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.614] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.614] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.614] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0125.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox", lpFilePart=0x0) returned 0x3d [0125.614] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\", lpFilePart=0x0) returned 0x3e [0125.615] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0125.615] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.615] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.615] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.615] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0125.615] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0125.615] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0125.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0125.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b [0125.616] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x4c [0125.616] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.616] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.617] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports", lpFilePart=0x0) returned 0x4b [0125.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\", lpFilePart=0x0) returned 0x4c [0125.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.618] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.618] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.TXT", lpFilePart=0x0) returned 0x54 [0125.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.620] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.png", lpFilePart=0x0) returned 0x54 [0125.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0125.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0125.622] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.vbs", lpFilePart=0x0) returned 0x54 [0125.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x80 [0125.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0125.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Crash Reports\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\crash reports\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0125.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0125.628] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0125.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0125.628] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.629] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.629] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.630] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.630] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.630] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0125.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles", lpFilePart=0x0) returned 0x46 [0125.630] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\", lpFilePart=0x0) returned 0x47 [0125.630] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0125.630] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.630] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0125.630] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0125.630] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0125.631] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0125.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57 [0125.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x58 [0125.631] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.644] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.645] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.646] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.646] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.647] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0125.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default", lpFilePart=0x0) returned 0x57 [0125.647] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\", lpFilePart=0x0) returned 0x58 [0125.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.648] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0125.649] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0125.649] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0125.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0125.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0125.650] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60 [0125.650] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", dwFileAttributes=0x80) returned 1 [0125.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.Horsuke", lpFilePart=0x0) returned 0x68 [0125.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0125.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0125.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0126.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60 [0126.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0126.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0126.173] GetFileType (hFile=0x23c) returned 0x1 [0126.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0126.173] GetFileType (hFile=0x23c) returned 0x1 [0126.173] ReadFile (in: hFile=0x23c, lpBuffer=0x22c1d68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22c1d68*, lpNumberOfBytesRead=0x2edce8*=0xfde, lpOverlapped=0x0) returned 1 [0126.177] ReadFile (in: hFile=0x23c, lpBuffer=0x22c1d2e, nNumberOfBytesToRead=0x22, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22c1d2e*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0126.178] ReadFile (in: hFile=0x23c, lpBuffer=0x22c1d68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x22c1d68*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0126.178] CloseHandle (hObject=0x23c) returned 1 [0126.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js", lpFilePart=0x0) returned 0x60 [0126.179] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\prefs.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\prefs.js")) returned 1 [0126.180] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67 [0126.180] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", dwFileAttributes=0x80) returned 1 [0126.181] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.Horsuke", lpFilePart=0x0) returned 0x6f [0126.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0126.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.182] GetFileType (hFile=0x15c) returned 0x1 [0126.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0126.182] GetFileType (hFile=0x15c) returned 0x1 [0126.638] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67 [0126.638] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0126.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0126.639] GetFileType (hFile=0x23c) returned 0x1 [0126.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0126.639] GetFileType (hFile=0x23c) returned 0x1 [0126.639] ReadFile (in: hFile=0x23c, lpBuffer=0x23ab7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23ab7f8*, lpNumberOfBytesRead=0x2edce8*=0xbc5, lpOverlapped=0x0) returned 1 [0126.650] ReadFile (in: hFile=0x23c, lpBuffer=0x23ab7a5, nNumberOfBytesToRead=0x3b, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23ab7a5*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0126.651] ReadFile (in: hFile=0x23c, lpBuffer=0x23ab7f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x23ab7f8*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0126.651] CloseHandle (hObject=0x23c) returned 1 [0126.651] WriteFile (in: hFile=0x15c, lpBuffer=0x23a9cb8*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x23a9cb8*, lpNumberOfBytesWritten=0x2edbb8*=0xbf0, lpOverlapped=0x0) returned 1 [0126.652] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js", lpFilePart=0x0) returned 0x67 [0126.652] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\sessionstore.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\sessionstore.js")) returned 1 [0126.652] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67 [0126.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x68 [0126.653] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.655] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.655] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.655] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.656] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups", lpFilePart=0x0) returned 0x67 [0126.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\", lpFilePart=0x0) returned 0x68 [0126.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.657] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.660] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.TXT", lpFilePart=0x0) returned 0x70 [0126.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.661] GetFileType (hFile=0x15c) returned 0x1 [0126.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.661] GetFileType (hFile=0x15c) returned 0x1 [0126.661] WriteFile (in: hFile=0x15c, lpBuffer=0x23b9ea0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x23b9ea0*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0126.662] CloseHandle (hObject=0x15c) returned 1 [0126.662] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.png", lpFilePart=0x0) returned 0x70 [0126.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0126.662] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.663] GetFileType (hFile=0x15c) returned 0x1 [0126.663] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0126.663] GetFileType (hFile=0x15c) returned 0x1 [0126.663] WriteFile (in: hFile=0x15c, lpBuffer=0x23bafb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x23bafb8*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.664] CloseHandle (hObject=0x15c) returned 1 [0126.664] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.vbs", lpFilePart=0x0) returned 0x70 [0126.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.664] GetFileType (hFile=0x15c) returned 0x1 [0126.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.665] GetFileType (hFile=0x15c) returned 0x1 [0126.665] WriteFile (in: hFile=0x15c, lpBuffer=0x23bec78*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x23bec78*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0126.665] CloseHandle (hObject=0x15c) returned 1 [0126.665] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9c [0126.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\bookmarkbackups\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\bookmarkbackups\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.666] GetFileType (hFile=0x15c) returned 0x1 [0126.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.666] GetFileType (hFile=0x15c) returned 0x1 [0126.666] WriteFile (in: hFile=0x15c, lpBuffer=0x23c1748*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x23c1748*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0126.667] CloseHandle (hObject=0x15c) returned 1 [0126.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61 [0126.667] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", lpFilePart=0x0) returned 0x62 [0126.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.668] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.668] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.668] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.668] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB", lpFilePart=0x0) returned 0x61 [0126.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\", lpFilePart=0x0) returned 0x62 [0126.668] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.669] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.669] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.669] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.669] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0126.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75 [0126.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x76 [0126.669] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf960 [0126.669] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0126.670] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0126.670] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0126.670] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0126.670] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0126.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0126.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0126.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", nBufferLength=0x105, lpBuffer=0x2ed700, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home", lpFilePart=0x0) returned 0x75 [0126.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", nBufferLength=0x105, lpBuffer=0x2ed6a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\", lpFilePart=0x0) returned 0x76 [0126.670] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\*", lpFindFileData=0x2ed8b0 | out: lpFindFileData=0x2ed8b0) returned 0x4cf960 [0126.670] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0126.670] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0126.671] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 1 [0126.671] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed900 | out: lpFindFileData=0x2ed900) returned 0 [0126.671] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb60) returned 1 [0126.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0126.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0126.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79 [0126.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x7a [0126.671] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf960 [0126.672] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0126.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0126.673] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0126.673] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0126.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0126.673] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", nBufferLength=0x105, lpBuffer=0x2ed680, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb", lpFilePart=0x0) returned 0x79 [0126.674] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", nBufferLength=0x105, lpBuffer=0x2ed620, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\", lpFilePart=0x0) returned 0x7a [0126.674] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\*", lpFindFileData=0x2ed830 | out: lpFindFileData=0x2ed830) returned 0x4cf960 [0126.674] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0126.674] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 1 [0126.675] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed880 | out: lpFindFileData=0x2ed880) returned 0 [0126.675] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edae0) returned 1 [0126.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edaa0) returned 1 [0126.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0126.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c [0126.676] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x8d [0126.676] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf960 [0126.677] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0126.677] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0126.677] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0126.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0126.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0126.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", nBufferLength=0x105, lpBuffer=0x2ed600, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht", lpFilePart=0x0) returned 0x8c [0126.677] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", nBufferLength=0x105, lpBuffer=0x2ed5a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\", lpFilePart=0x0) returned 0x8d [0126.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\*", lpFindFileData=0x2ed7b0 | out: lpFindFileData=0x2ed7b0) returned 0x4cf960 [0126.678] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 1 [0126.678] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed800 | out: lpFindFileData=0x2ed800) returned 0 [0126.678] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda60) returned 1 [0126.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda20) returned 1 [0126.679] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.TXT", lpFilePart=0x0) returned 0x95 [0126.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0126.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.680] GetFileType (hFile=0x15c) returned 0x1 [0126.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0126.680] GetFileType (hFile=0x15c) returned 0x1 [0126.680] WriteFile (in: hFile=0x15c, lpBuffer=0x23d8690*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x23d8690*, lpNumberOfBytesWritten=0x2ed9f8*=0x39b, lpOverlapped=0x0) returned 1 [0126.681] CloseHandle (hObject=0x15c) returned 1 [0126.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed530, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.png", lpFilePart=0x0) returned 0x95 [0126.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda10) returned 1 [0126.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.682] GetFileType (hFile=0x15c) returned 0x1 [0126.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed980) returned 1 [0126.682] GetFileType (hFile=0x15c) returned 0x1 [0126.682] WriteFile (in: hFile=0x15c, lpBuffer=0x23d97f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edb38, lpOverlapped=0x0 | out: lpBuffer=0x23d97f0*, lpNumberOfBytesWritten=0x2edb38*=0x2337, lpOverlapped=0x0) returned 1 [0126.683] CloseHandle (hObject=0x15c) returned 1 [0126.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.vbs", lpFilePart=0x0) returned 0x95 [0126.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0126.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.683] GetFileType (hFile=0x15c) returned 0x1 [0126.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0126.683] GetFileType (hFile=0x15c) returned 0x1 [0126.683] WriteFile (in: hFile=0x15c, lpBuffer=0x23dd588*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ed998, lpOverlapped=0x0 | out: lpBuffer=0x23dd588*, lpNumberOfBytesWritten=0x2ed998*=0x13c, lpOverlapped=0x0) returned 1 [0126.684] CloseHandle (hObject=0x15c) returned 1 [0126.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed470, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xc1 [0126.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed950) returned 1 [0126.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\818200132aebmoouht\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\818200132aebmoouht\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.696] GetFileType (hFile=0x15c) returned 0x1 [0126.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed8c0) returned 1 [0126.696] GetFileType (hFile=0x15c) returned 0x1 [0126.697] WriteFile (in: hFile=0x15c, lpBuffer=0x23e00e8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ed9f8, lpOverlapped=0x0 | out: lpBuffer=0x23e00e8*, lpNumberOfBytesWritten=0x2ed9f8*=0xc6, lpOverlapped=0x0) returned 1 [0126.697] CloseHandle (hObject=0x15c) returned 1 [0126.697] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.TXT", lpFilePart=0x0) returned 0x82 [0126.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0126.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.698] GetFileType (hFile=0x15c) returned 0x1 [0126.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0126.698] GetFileType (hFile=0x15c) returned 0x1 [0126.699] WriteFile (in: hFile=0x15c, lpBuffer=0x23ea4e0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x23ea4e0*, lpNumberOfBytesWritten=0x2eda78*=0x39b, lpOverlapped=0x0) returned 1 [0126.699] CloseHandle (hObject=0x15c) returned 1 [0126.699] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed5b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.png", lpFilePart=0x0) returned 0x82 [0126.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda90) returned 1 [0126.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.700] GetFileType (hFile=0x15c) returned 0x1 [0126.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda00) returned 1 [0126.700] GetFileType (hFile=0x15c) returned 0x1 [0126.700] WriteFile (in: hFile=0x15c, lpBuffer=0x23eb618*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edbb8, lpOverlapped=0x0 | out: lpBuffer=0x23eb618*, lpNumberOfBytesWritten=0x2edbb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.701] CloseHandle (hObject=0x15c) returned 1 [0126.701] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.vbs", lpFilePart=0x0) returned 0x82 [0126.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0126.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.701] GetFileType (hFile=0x15c) returned 0x1 [0126.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0126.701] GetFileType (hFile=0x15c) returned 0x1 [0126.701] WriteFile (in: hFile=0x15c, lpBuffer=0x23ef338*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda18, lpOverlapped=0x0 | out: lpBuffer=0x23ef338*, lpNumberOfBytesWritten=0x2eda18*=0x13c, lpOverlapped=0x0) returned 1 [0126.702] CloseHandle (hObject=0x15c) returned 1 [0126.702] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed4f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xae [0126.702] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ed9d0) returned 1 [0126.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\idb\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\idb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.703] GetFileType (hFile=0x15c) returned 0x1 [0126.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed940) returned 1 [0126.703] GetFileType (hFile=0x15c) returned 0x1 [0126.703] WriteFile (in: hFile=0x15c, lpBuffer=0x23f1e48*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eda78, lpOverlapped=0x0 | out: lpBuffer=0x23f1e48*, lpNumberOfBytesWritten=0x2eda78*=0xc6, lpOverlapped=0x0) returned 1 [0126.704] CloseHandle (hObject=0x15c) returned 1 [0126.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.TXT", lpFilePart=0x0) returned 0x7e [0126.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0126.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.704] GetFileType (hFile=0x15c) returned 0x1 [0126.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0126.704] GetFileType (hFile=0x15c) returned 0x1 [0126.705] WriteFile (in: hFile=0x15c, lpBuffer=0x23fc230*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x23fc230*, lpNumberOfBytesWritten=0x2edaf8*=0x39b, lpOverlapped=0x0) returned 1 [0126.705] CloseHandle (hObject=0x15c) returned 1 [0126.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed630, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.png", lpFilePart=0x0) returned 0x7e [0126.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb10) returned 1 [0126.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.706] GetFileType (hFile=0x15c) returned 0x1 [0126.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda80) returned 1 [0126.706] GetFileType (hFile=0x15c) returned 0x1 [0126.706] WriteFile (in: hFile=0x15c, lpBuffer=0x23fd360*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edc38, lpOverlapped=0x0 | out: lpBuffer=0x23fd360*, lpNumberOfBytesWritten=0x2edc38*=0x2337, lpOverlapped=0x0) returned 1 [0126.707] CloseHandle (hObject=0x15c) returned 1 [0126.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.vbs", lpFilePart=0x0) returned 0x7e [0126.707] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0126.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.709] GetFileType (hFile=0x15c) returned 0x1 [0126.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0126.709] GetFileType (hFile=0x15c) returned 0x1 [0126.709] WriteFile (in: hFile=0x15c, lpBuffer=0x2401068*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2eda98, lpOverlapped=0x0 | out: lpBuffer=0x2401068*, lpNumberOfBytesWritten=0x2eda98*=0x13c, lpOverlapped=0x0) returned 1 [0126.710] CloseHandle (hObject=0x15c) returned 1 [0126.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed570, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xaa [0126.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eda50) returned 1 [0126.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\moz-safe-about+home\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\moz-safe-about+home\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.711] GetFileType (hFile=0x15c) returned 0x1 [0126.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ed9c0) returned 1 [0126.711] GetFileType (hFile=0x15c) returned 0x1 [0126.711] WriteFile (in: hFile=0x15c, lpBuffer=0x2403b68*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edaf8, lpOverlapped=0x0 | out: lpBuffer=0x2403b68*, lpNumberOfBytesWritten=0x2edaf8*=0xc6, lpOverlapped=0x0) returned 1 [0126.712] CloseHandle (hObject=0x15c) returned 1 [0126.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.TXT", lpFilePart=0x0) returned 0x6a [0126.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.713] GetFileType (hFile=0x15c) returned 0x1 [0126.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.713] GetFileType (hFile=0x15c) returned 0x1 [0126.713] WriteFile (in: hFile=0x15c, lpBuffer=0x240df00*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x240df00*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0126.714] CloseHandle (hObject=0x15c) returned 1 [0126.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.png", lpFilePart=0x0) returned 0x6a [0126.714] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0126.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.715] GetFileType (hFile=0x15c) returned 0x1 [0126.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0126.715] GetFileType (hFile=0x15c) returned 0x1 [0126.715] WriteFile (in: hFile=0x15c, lpBuffer=0x240f008*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x240f008*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.716] CloseHandle (hObject=0x15c) returned 1 [0126.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.vbs", lpFilePart=0x0) returned 0x6a [0126.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.717] GetFileType (hFile=0x15c) returned 0x1 [0126.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.717] GetFileType (hFile=0x15c) returned 0x1 [0126.717] WriteFile (in: hFile=0x15c, lpBuffer=0x2412c98*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x2412c98*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0126.718] CloseHandle (hObject=0x15c) returned 1 [0126.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x96 [0126.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\indexedDB\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\indexeddb\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.720] GetFileType (hFile=0x15c) returned 0x1 [0126.720] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.720] GetFileType (hFile=0x15c) returned 0x1 [0126.720] WriteFile (in: hFile=0x15c, lpBuffer=0x2415748*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2415748*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0126.721] CloseHandle (hObject=0x15c) returned 1 [0126.721] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61 [0126.721] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", lpFilePart=0x0) returned 0x62 [0126.721] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.722] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.722] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.722] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps", lpFilePart=0x0) returned 0x61 [0126.722] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\", lpFilePart=0x0) returned 0x62 [0126.722] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.723] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.723] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.723] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.723] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.723] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.TXT", lpFilePart=0x0) returned 0x6a [0126.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.724] GetFileType (hFile=0x15c) returned 0x1 [0126.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.724] GetFileType (hFile=0x15c) returned 0x1 [0126.724] WriteFile (in: hFile=0x15c, lpBuffer=0x2422150*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2422150*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0126.725] CloseHandle (hObject=0x15c) returned 1 [0126.725] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.png", lpFilePart=0x0) returned 0x6a [0126.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0126.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0126.727] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.vbs", lpFilePart=0x0) returned 0x6a [0126.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x96 [0126.728] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\minidumps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\minidumps\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f [0126.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", lpFilePart=0x0) returned 0x60 [0126.731] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.733] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.733] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.733] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.734] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps", lpFilePart=0x0) returned 0x5f [0126.734] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\", lpFilePart=0x0) returned 0x60 [0126.734] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0126.734] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.734] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0126.734] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0126.734] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0126.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0126.735] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.TXT", lpFilePart=0x0) returned 0x68 [0126.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.735] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.738] WriteFile (in: hFile=0x15c, lpBuffer=0x22394b0*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x22394b0*, lpNumberOfBytesWritten=0x2edb78*=0x39b, lpOverlapped=0x0) returned 1 [0126.738] CloseHandle (hObject=0x15c) returned 1 [0126.739] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.png", lpFilePart=0x0) returned 0x68 [0126.739] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0126.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.739] GetFileType (hFile=0x15c) returned 0x1 [0126.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0126.739] GetFileType (hFile=0x15c) returned 0x1 [0126.739] WriteFile (in: hFile=0x15c, lpBuffer=0x223a5b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x223a5b8*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.740] CloseHandle (hObject=0x15c) returned 1 [0126.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.vbs", lpFilePart=0x0) returned 0x68 [0126.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.741] GetFileType (hFile=0x15c) returned 0x1 [0126.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.741] GetFileType (hFile=0x15c) returned 0x1 [0126.741] WriteFile (in: hFile=0x15c, lpBuffer=0x223e248*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb18, lpOverlapped=0x0 | out: lpBuffer=0x223e248*, lpNumberOfBytesWritten=0x2edb18*=0x13c, lpOverlapped=0x0) returned 1 [0126.742] CloseHandle (hObject=0x15c) returned 1 [0126.742] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x94 [0126.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0126.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\webapps\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\webapps\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.744] GetFileType (hFile=0x15c) returned 0x1 [0126.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0126.744] GetFileType (hFile=0x15c) returned 0x1 [0126.744] WriteFile (in: hFile=0x15c, lpBuffer=0x2240cf8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edb78, lpOverlapped=0x0 | out: lpBuffer=0x2240cf8*, lpNumberOfBytesWritten=0x2edb78*=0xc6, lpOverlapped=0x0) returned 1 [0126.745] CloseHandle (hObject=0x15c) returned 1 [0126.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0126.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0126.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.748] GetFileType (hFile=0x15c) returned 0x1 [0126.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0126.748] GetFileType (hFile=0x15c) returned 0x1 [0126.748] WriteFile (in: hFile=0x15c, lpBuffer=0x224b070*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x224b070*, lpNumberOfBytesWritten=0x2edbf8*=0x39b, lpOverlapped=0x0) returned 1 [0126.749] CloseHandle (hObject=0x15c) returned 1 [0126.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.png", lpFilePart=0x0) returned 0x60 [0126.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0126.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.750] GetFileType (hFile=0x15c) returned 0x1 [0126.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0126.750] GetFileType (hFile=0x15c) returned 0x1 [0126.750] WriteFile (in: hFile=0x15c, lpBuffer=0x224c168*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x224c168*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0126.751] CloseHandle (hObject=0x15c) returned 1 [0126.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0126.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0126.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.752] GetFileType (hFile=0x15c) returned 0x1 [0126.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0126.752] GetFileType (hFile=0x15c) returned 0x1 [0126.752] WriteFile (in: hFile=0x15c, lpBuffer=0x224fdc8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edb98, lpOverlapped=0x0 | out: lpBuffer=0x224fdc8*, lpNumberOfBytesWritten=0x2edb98*=0x13c, lpOverlapped=0x0) returned 1 [0126.752] CloseHandle (hObject=0x15c) returned 1 [0126.752] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0126.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0126.752] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\silmbjec.default\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.753] GetFileType (hFile=0x15c) returned 0x1 [0126.753] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0126.753] GetFileType (hFile=0x15c) returned 0x1 [0126.753] WriteFile (in: hFile=0x15c, lpBuffer=0x2252858*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edbf8, lpOverlapped=0x0 | out: lpBuffer=0x2252858*, lpNumberOfBytesWritten=0x2edbf8*=0xc6, lpOverlapped=0x0) returned 1 [0126.754] CloseHandle (hObject=0x15c) returned 1 [0126.756] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.TXT", lpFilePart=0x0) returned 0x4f [0126.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0126.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.756] GetFileType (hFile=0x15c) returned 0x1 [0126.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0126.756] GetFileType (hFile=0x15c) returned 0x1 [0126.756] WriteFile (in: hFile=0x15c, lpBuffer=0x225cb80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x225cb80*, lpNumberOfBytesWritten=0x2edc78*=0x39b, lpOverlapped=0x0) returned 1 [0126.757] CloseHandle (hObject=0x15c) returned 1 [0126.757] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.png", lpFilePart=0x0) returned 0x4f [0126.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0126.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.758] GetFileType (hFile=0x15c) returned 0x1 [0126.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0126.758] GetFileType (hFile=0x15c) returned 0x1 [0126.758] WriteFile (in: hFile=0x15c, lpBuffer=0x225dc50*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x225dc50*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.759] CloseHandle (hObject=0x15c) returned 1 [0126.759] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.vbs", lpFilePart=0x0) returned 0x4f [0126.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0126.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.759] GetFileType (hFile=0x15c) returned 0x1 [0126.759] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0126.759] GetFileType (hFile=0x15c) returned 0x1 [0126.759] WriteFile (in: hFile=0x15c, lpBuffer=0x2261838*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc18, lpOverlapped=0x0 | out: lpBuffer=0x2261838*, lpNumberOfBytesWritten=0x2edc18*=0x13c, lpOverlapped=0x0) returned 1 [0126.760] CloseHandle (hObject=0x15c) returned 1 [0126.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7b [0126.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0126.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\profiles\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.762] GetFileType (hFile=0x15c) returned 0x1 [0126.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0126.762] GetFileType (hFile=0x15c) returned 0x1 [0126.762] WriteFile (in: hFile=0x15c, lpBuffer=0x2264278*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edc78, lpOverlapped=0x0 | out: lpBuffer=0x2264278*, lpNumberOfBytesWritten=0x2edc78*=0xc6, lpOverlapped=0x0) returned 1 [0126.762] CloseHandle (hObject=0x15c) returned 1 [0126.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.TXT", lpFilePart=0x0) returned 0x46 [0126.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0126.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.763] GetFileType (hFile=0x15c) returned 0x1 [0126.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0126.763] GetFileType (hFile=0x15c) returned 0x1 [0126.764] WriteFile (in: hFile=0x15c, lpBuffer=0x226e580*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x226e580*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0126.764] CloseHandle (hObject=0x15c) returned 1 [0126.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.png", lpFilePart=0x0) returned 0x46 [0126.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0126.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.765] GetFileType (hFile=0x15c) returned 0x1 [0126.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0126.765] GetFileType (hFile=0x15c) returned 0x1 [0126.765] WriteFile (in: hFile=0x15c, lpBuffer=0x226f640*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x226f640*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0126.766] CloseHandle (hObject=0x15c) returned 1 [0126.766] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.vbs", lpFilePart=0x0) returned 0x46 [0126.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0126.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.769] GetFileType (hFile=0x15c) returned 0x1 [0126.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0126.769] GetFileType (hFile=0x15c) returned 0x1 [0126.769] WriteFile (in: hFile=0x15c, lpBuffer=0x22731f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22731f8*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0126.770] CloseHandle (hObject=0x15c) returned 1 [0126.770] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x72 [0126.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0126.770] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Firefox\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\firefox\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.771] GetFileType (hFile=0x15c) returned 0x1 [0126.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0126.771] GetFileType (hFile=0x15c) returned 0x1 [0126.771] WriteFile (in: hFile=0x15c, lpBuffer=0x2275c18*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x2275c18*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0126.772] CloseHandle (hObject=0x15c) returned 1 [0126.772] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.TXT", lpFilePart=0x0) returned 0x3e [0126.772] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0126.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.772] GetFileType (hFile=0x15c) returned 0x1 [0126.772] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0126.772] GetFileType (hFile=0x15c) returned 0x1 [0126.773] WriteFile (in: hFile=0x15c, lpBuffer=0x227ff00*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x227ff00*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0126.774] CloseHandle (hObject=0x15c) returned 1 [0126.774] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x3e [0126.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0126.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.774] GetFileType (hFile=0x15c) returned 0x1 [0126.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0126.774] GetFileType (hFile=0x15c) returned 0x1 [0126.774] WriteFile (in: hFile=0x15c, lpBuffer=0x2280fb0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2280fb0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.775] CloseHandle (hObject=0x15c) returned 1 [0126.775] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.vbs", lpFilePart=0x0) returned 0x3e [0126.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0126.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.776] GetFileType (hFile=0x15c) returned 0x1 [0126.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0126.776] GetFileType (hFile=0x15c) returned 0x1 [0126.776] WriteFile (in: hFile=0x15c, lpBuffer=0x2284b38*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2284b38*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0126.776] CloseHandle (hObject=0x15c) returned 1 [0126.777] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6a [0126.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0126.777] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\mozilla\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.780] GetFileType (hFile=0x15c) returned 0x1 [0126.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0126.780] GetFileType (hFile=0x15c) returned 0x1 [0126.780] WriteFile (in: hFile=0x15c, lpBuffer=0x2287538*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x2287538*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0126.781] CloseHandle (hObject=0x15c) returned 1 [0126.781] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.TXT", lpFilePart=0x0) returned 0x36 [0126.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0126.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.782] GetFileType (hFile=0x15c) returned 0x1 [0126.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0126.782] GetFileType (hFile=0x15c) returned 0x1 [0126.782] WriteFile (in: hFile=0x15c, lpBuffer=0x2291800*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2291800*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0126.783] CloseHandle (hObject=0x15c) returned 1 [0126.783] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.png", lpFilePart=0x0) returned 0x36 [0126.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0126.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.784] GetFileType (hFile=0x15c) returned 0x1 [0126.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0126.784] GetFileType (hFile=0x15c) returned 0x1 [0126.784] WriteFile (in: hFile=0x15c, lpBuffer=0x22928a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22928a0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0126.785] CloseHandle (hObject=0x15c) returned 1 [0126.785] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.vbs", lpFilePart=0x0) returned 0x36 [0126.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0126.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.785] GetFileType (hFile=0x15c) returned 0x1 [0126.785] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0126.785] GetFileType (hFile=0x15c) returned 0x1 [0126.786] WriteFile (in: hFile=0x15c, lpBuffer=0x22963f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x22963f8*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0126.786] CloseHandle (hObject=0x15c) returned 1 [0126.786] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x62 [0126.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0126.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.787] GetFileType (hFile=0x15c) returned 0x1 [0126.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0126.787] GetFileType (hFile=0x15c) returned 0x1 [0126.787] WriteFile (in: hFile=0x15c, lpBuffer=0x2298dd8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2298dd8*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0126.788] CloseHandle (hObject=0x15c) returned 1 [0126.788] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0126.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.788] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.789] GetFileType (hFile=0x15c) returned 0x1 [0126.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.789] GetFileType (hFile=0x15c) returned 0x1 [0126.789] WriteFile (in: hFile=0x15c, lpBuffer=0x22a3080*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22a3080*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0126.790] CloseHandle (hObject=0x15c) returned 1 [0126.790] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.png", lpFilePart=0x0) returned 0x2e [0126.790] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0126.790] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.791] GetFileType (hFile=0x15c) returned 0x1 [0126.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0126.791] GetFileType (hFile=0x15c) returned 0x1 [0126.791] WriteFile (in: hFile=0x15c, lpBuffer=0x22a4110*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22a4110*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.792] CloseHandle (hObject=0x15c) returned 1 [0126.792] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0126.792] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.793] GetFileType (hFile=0x15c) returned 0x1 [0126.793] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.793] GetFileType (hFile=0x15c) returned 0x1 [0126.793] WriteFile (in: hFile=0x15c, lpBuffer=0x22a7c38*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22a7c38*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0126.794] CloseHandle (hObject=0x15c) returned 1 [0126.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0126.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.820] GetFileType (hFile=0x15c) returned 0x1 [0126.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.821] GetFileType (hFile=0x15c) returned 0x1 [0126.821] WriteFile (in: hFile=0x15c, lpBuffer=0x22aa5f8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22aa5f8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0126.822] CloseHandle (hObject=0x15c) returned 1 [0126.822] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0126.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data", lpFilePart=0x0) returned 0x2e [0126.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\", lpFilePart=0x0) returned 0x2f [0126.822] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0126.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0126.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0126.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.827] GetFileType (hFile=0x15c) returned 0x1 [0126.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.827] GetFileType (hFile=0x15c) returned 0x1 [0126.827] WriteFile (in: hFile=0x15c, lpBuffer=0x22b5c88*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22b5c88*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0126.828] CloseHandle (hObject=0x15c) returned 1 [0126.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.png", lpFilePart=0x0) returned 0x37 [0126.828] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0126.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.829] GetFileType (hFile=0x15c) returned 0x1 [0126.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0126.829] GetFileType (hFile=0x15c) returned 0x1 [0126.829] WriteFile (in: hFile=0x15c, lpBuffer=0x22b6d28*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22b6d28*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.829] CloseHandle (hObject=0x15c) returned 1 [0126.830] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0126.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.830] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.830] GetFileType (hFile=0x15c) returned 0x1 [0126.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.830] GetFileType (hFile=0x15c) returned 0x1 [0126.830] WriteFile (in: hFile=0x15c, lpBuffer=0x22ba880*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22ba880*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0126.831] CloseHandle (hObject=0x15c) returned 1 [0126.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0126.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\application data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.832] GetFileType (hFile=0x15c) returned 0x1 [0126.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.832] GetFileType (hFile=0x15c) returned 0x1 [0126.832] WriteFile (in: hFile=0x15c, lpBuffer=0x22bd260*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22bd260*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0126.833] CloseHandle (hObject=0x15c) returned 1 [0126.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0126.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0126.833] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0126.833] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0126.833] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.833] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.834] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0126.834] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0126.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0126.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0126.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts", lpFilePart=0x0) returned 0x26 [0126.834] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\", lpFilePart=0x0) returned 0x27 [0126.835] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0126.835] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.835] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.835] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.835] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.835] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.835] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.836] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.836] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.836] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0126.836] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0126.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0126.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.TXT", lpFilePart=0x0) returned 0x2f [0126.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.838] GetFileType (hFile=0x15c) returned 0x1 [0126.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.838] GetFileType (hFile=0x15c) returned 0x1 [0126.839] WriteFile (in: hFile=0x15c, lpBuffer=0x22cace8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22cace8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0126.839] CloseHandle (hObject=0x15c) returned 1 [0126.839] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.png", lpFilePart=0x0) returned 0x2f [0126.839] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0126.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.840] GetFileType (hFile=0x15c) returned 0x1 [0126.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0126.840] GetFileType (hFile=0x15c) returned 0x1 [0126.840] WriteFile (in: hFile=0x15c, lpBuffer=0x22cbd78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22cbd78*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.841] CloseHandle (hObject=0x15c) returned 1 [0126.841] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.vbs", lpFilePart=0x0) returned 0x2f [0126.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.841] GetFileType (hFile=0x15c) returned 0x1 [0126.841] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.842] GetFileType (hFile=0x15c) returned 0x1 [0126.842] WriteFile (in: hFile=0x15c, lpBuffer=0x22cf8a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22cf8a0*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0126.843] CloseHandle (hObject=0x15c) returned 1 [0126.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5b [0126.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Contacts\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\contacts\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.844] GetFileType (hFile=0x15c) returned 0x1 [0126.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.844] GetFileType (hFile=0x15c) returned 0x1 [0126.844] WriteFile (in: hFile=0x15c, lpBuffer=0x22d2260*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22d2260*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0126.845] CloseHandle (hObject=0x15c) returned 1 [0126.845] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0126.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies", lpFilePart=0x0) returned 0x25 [0126.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\", lpFilePart=0x0) returned 0x26 [0126.845] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0126.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0126.849] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0126.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.849] GetFileType (hFile=0x15c) returned 0x1 [0126.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.850] GetFileType (hFile=0x15c) returned 0x1 [0126.850] WriteFile (in: hFile=0x15c, lpBuffer=0x22dd808*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22dd808*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0126.851] CloseHandle (hObject=0x15c) returned 1 [0126.851] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.png", lpFilePart=0x0) returned 0x2e [0126.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0126.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.851] GetFileType (hFile=0x15c) returned 0x1 [0126.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0126.852] GetFileType (hFile=0x15c) returned 0x1 [0126.852] WriteFile (in: hFile=0x15c, lpBuffer=0x22de898*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22de898*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0126.852] CloseHandle (hObject=0x15c) returned 1 [0126.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0126.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.853] GetFileType (hFile=0x15c) returned 0x1 [0126.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.853] GetFileType (hFile=0x15c) returned 0x1 [0126.853] WriteFile (in: hFile=0x15c, lpBuffer=0x22e23c0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22e23c0*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0126.854] CloseHandle (hObject=0x15c) returned 1 [0126.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0126.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0126.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Cookies\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\cookies\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0126.855] GetFileType (hFile=0x15c) returned 0x1 [0126.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0126.855] GetFileType (hFile=0x15c) returned 0x1 [0126.855] WriteFile (in: hFile=0x15c, lpBuffer=0x22e4d80*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22e4d80*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0126.856] CloseHandle (hObject=0x15c) returned 1 [0126.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0126.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0126.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0126.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0126.856] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0126.860] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0126.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0126.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0126.860] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x0) returned 0x25 [0126.861] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\", lpFilePart=0x0) returned 0x26 [0126.861] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0126.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0126.864] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0126.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0126.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0126.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", lpFilePart=0x0) returned 0x32 [0126.864] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", dwFileAttributes=0x80) returned 1 [0126.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls.Horsuke", lpFilePart=0x0) returned 0x3a [0126.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0126.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3zcunio_.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0126.867] GetFileType (hFile=0x15c) returned 0x1 [0126.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0126.867] GetFileType (hFile=0x15c) returned 0x1 [0127.314] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", lpFilePart=0x0) returned 0x32 [0127.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0127.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3zcunio_.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0127.315] GetFileType (hFile=0x23c) returned 0x1 [0127.315] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0127.315] GetFileType (hFile=0x23c) returned 0x1 [0127.315] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7c10*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.320] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7c10*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.320] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7c10*, lpNumberOfBytesRead=0x2edf68*=0x185, lpOverlapped=0x0) returned 1 [0127.320] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7c10, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7c10*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0127.320] CloseHandle (hObject=0x23c) returned 1 [0127.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls", lpFilePart=0x0) returned 0x32 [0127.321] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\3ZcUNio_.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\3zcunio_.xls")) returned 1 [0127.322] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", lpFilePart=0x0) returned 0x2f [0127.322] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", dwFileAttributes=0x80) returned 1 [0127.323] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg.Horsuke", lpFilePart=0x0) returned 0x37 [0127.323] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0127.323] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6q_4t.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0127.324] GetFileType (hFile=0x15c) returned 0x1 [0127.324] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0127.324] GetFileType (hFile=0x15c) returned 0x1 [0127.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", lpFilePart=0x0) returned 0x2f [0127.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0127.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6q_4t.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0127.856] GetFileType (hFile=0x23c) returned 0x1 [0127.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0127.856] GetFileType (hFile=0x23c) returned 0x1 [0127.856] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.860] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.861] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.861] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.861] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.861] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.861] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0127.862] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0xe5c, lpOverlapped=0x0) returned 1 [0127.862] ReadFile (in: hFile=0x23c, lpBuffer=0x22c24cc, nNumberOfBytesToRead=0x1a4, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c24cc*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0127.862] ReadFile (in: hFile=0x23c, lpBuffer=0x22c2688, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c2688*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0127.862] CloseHandle (hObject=0x23c) returned 1 [0127.862] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg", lpFilePart=0x0) returned 0x2f [0127.862] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\6Q_4T.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\6q_4t.jpg")) returned 1 [0127.864] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", lpFilePart=0x0) returned 0x35 [0127.864] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", dwFileAttributes=0x80) returned 1 [0127.865] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi.Horsuke", lpFilePart=0x0) returned 0x3d [0127.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0127.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\951aqafp0uh.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0127.867] GetFileType (hFile=0x15c) returned 0x1 [0127.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0127.867] GetFileType (hFile=0x15c) returned 0x1 [0128.466] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", lpFilePart=0x0) returned 0x35 [0128.466] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0128.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\951aqafp0uh.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0128.467] GetFileType (hFile=0x23c) returned 0x1 [0128.467] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0128.467] GetFileType (hFile=0x23c) returned 0x1 [0128.467] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.471] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.472] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.472] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.472] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.472] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.472] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.473] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.473] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.473] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.473] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.473] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.474] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.474] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.474] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.474] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.475] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0xa44, lpOverlapped=0x0) returned 1 [0128.475] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2d8c, nNumberOfBytesToRead=0x1bc, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2d8c*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0128.475] ReadFile (in: hFile=0x23c, lpBuffer=0x23b2f60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b2f60*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0128.475] CloseHandle (hObject=0x23c) returned 1 [0128.476] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi", lpFilePart=0x0) returned 0x35 [0128.476] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\951aQAFp0Uh.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\951aqafp0uh.avi")) returned 1 [0128.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", lpFilePart=0x0) returned 0x3b [0128.477] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", dwFileAttributes=0x80) returned 1 [0128.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf.Horsuke", lpFilePart=0x0) returned 0x43 [0128.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0128.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cmxh3jbzeajzsw-py.pdf.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0128.480] GetFileType (hFile=0x15c) returned 0x1 [0128.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0128.480] GetFileType (hFile=0x15c) returned 0x1 [0128.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", lpFilePart=0x0) returned 0x3b [0128.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0128.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cmxh3jbzeajzsw-py.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0128.927] GetFileType (hFile=0x23c) returned 0x1 [0128.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0128.927] GetFileType (hFile=0x23c) returned 0x1 [0128.927] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.931] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.932] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.932] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.936] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.936] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.936] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.936] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0128.937] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0xc08, lpOverlapped=0x0) returned 1 [0128.937] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac498, nNumberOfBytesToRead=0x3f8, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac498*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0128.937] ReadFile (in: hFile=0x23c, lpBuffer=0x22ac8a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ac8a8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0128.937] CloseHandle (hObject=0x23c) returned 1 [0128.937] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf", lpFilePart=0x0) returned 0x3b [0128.937] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\cmxh3JbzeAjZsw-Py.pdf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\cmxh3jbzeajzsw-py.pdf")) returned 1 [0128.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", lpFilePart=0x0) returned 0x33 [0128.939] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", dwFileAttributes=0x80) returned 1 [0128.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png.Horsuke", lpFilePart=0x0) returned 0x3b [0128.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0128.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\exq3ukwwd.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0128.942] GetFileType (hFile=0x15c) returned 0x1 [0128.942] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0128.942] GetFileType (hFile=0x15c) returned 0x1 [0129.472] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", lpFilePart=0x0) returned 0x33 [0129.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0129.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\exq3ukwwd.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0129.473] GetFileType (hFile=0x23c) returned 0x1 [0129.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0129.473] GetFileType (hFile=0x23c) returned 0x1 [0129.473] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.478] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.478] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.478] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.478] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x264, lpOverlapped=0x0) returned 1 [0129.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a9470*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0129.538] CloseHandle (hObject=0x23c) returned 1 [0129.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png", lpFilePart=0x0) returned 0x33 [0129.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\exq3ukwWd.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\exq3ukwwd.png")) returned 1 [0129.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", lpFilePart=0x0) returned 0x3a [0129.540] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", dwFileAttributes=0x80) returned 1 [0129.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png.Horsuke", lpFilePart=0x0) returned 0x42 [0129.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0129.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffaoopuldszz3ops.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0129.543] GetFileType (hFile=0x15c) returned 0x1 [0129.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0129.543] GetFileType (hFile=0x15c) returned 0x1 [0129.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", lpFilePart=0x0) returned 0x3a [0129.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0129.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffaoopuldszz3ops.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0129.987] GetFileType (hFile=0x23c) returned 0x1 [0129.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0129.987] GetFileType (hFile=0x23c) returned 0x1 [0129.987] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0129.992] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.046] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.047] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.047] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.047] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.047] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.048] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.048] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.048] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.048] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.048] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.049] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x463, lpOverlapped=0x0) returned 1 [0130.049] ReadFile (in: hFile=0x23c, lpBuffer=0x2297e2b, nNumberOfBytesToRead=0x39d, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2297e2b*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0130.049] ReadFile (in: hFile=0x23c, lpBuffer=0x22981e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22981e0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0130.049] CloseHandle (hObject=0x23c) returned 1 [0130.049] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png", lpFilePart=0x0) returned 0x3a [0130.049] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ffAoOpUldSzZ3oPs.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\ffaoopuldszz3ops.png")) returned 1 [0130.051] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", lpFilePart=0x0) returned 0x2e [0130.051] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", dwFileAttributes=0x80) returned 1 [0130.052] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv.Horsuke", lpFilePart=0x0) returned 0x36 [0130.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0130.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h e2.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0130.053] GetFileType (hFile=0x15c) returned 0x1 [0130.053] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0130.053] GetFileType (hFile=0x15c) returned 0x1 [0130.632] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", lpFilePart=0x0) returned 0x2e [0130.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0130.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h e2.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0130.633] GetFileType (hFile=0x23c) returned 0x1 [0130.633] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0130.633] GetFileType (hFile=0x23c) returned 0x1 [0130.633] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.638] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.638] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.638] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.639] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.639] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.639] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.639] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.639] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.640] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.640] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.640] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.640] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.640] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.641] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.641] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.641] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.641] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.641] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.642] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0130.642] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x93, lpOverlapped=0x0) returned 1 [0130.642] ReadFile (in: hFile=0x23c, lpBuffer=0x238d1a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238d1a0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0130.642] CloseHandle (hObject=0x23c) returned 1 [0130.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv", lpFilePart=0x0) returned 0x2e [0130.642] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\H e2.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\h e2.flv")) returned 1 [0130.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", lpFilePart=0x0) returned 0x34 [0130.644] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", dwFileAttributes=0x80) returned 1 [0130.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc.Horsuke", lpFilePart=0x0) returned 0x3c [0130.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0130.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k16ilpzful.doc.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0130.646] GetFileType (hFile=0x15c) returned 0x1 [0130.647] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0130.647] GetFileType (hFile=0x15c) returned 0x1 [0131.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", lpFilePart=0x0) returned 0x34 [0131.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0131.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k16ilpzful.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0131.158] GetFileType (hFile=0x23c) returned 0x1 [0131.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0131.159] GetFileType (hFile=0x23c) returned 0x1 [0131.159] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.163] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.164] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.164] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.164] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.164] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.164] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.165] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.165] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.165] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.165] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.165] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.166] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.166] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.166] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.166] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.166] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.167] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.167] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.167] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.167] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.167] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.168] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.168] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x918, lpOverlapped=0x0) returned 1 [0131.168] ReadFile (in: hFile=0x23c, lpBuffer=0x2289648, nNumberOfBytesToRead=0x2e8, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289648*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0131.168] ReadFile (in: hFile=0x23c, lpBuffer=0x2289948, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2289948*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0131.168] CloseHandle (hObject=0x23c) returned 1 [0131.169] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc", lpFilePart=0x0) returned 0x34 [0131.169] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\k16ILPZful.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\k16ilpzful.doc")) returned 1 [0131.171] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", lpFilePart=0x0) returned 0x33 [0131.171] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", dwFileAttributes=0x80) returned 1 [0131.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a.Horsuke", lpFilePart=0x0) returned 0x3b [0131.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0131.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kutkrhb6a.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0131.173] GetFileType (hFile=0x15c) returned 0x1 [0131.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0131.173] GetFileType (hFile=0x15c) returned 0x1 [0131.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", lpFilePart=0x0) returned 0x33 [0131.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0131.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kutkrhb6a.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0131.711] GetFileType (hFile=0x23c) returned 0x1 [0131.711] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0131.711] GetFileType (hFile=0x23c) returned 0x1 [0131.711] ReadFile (in: hFile=0x23c, lpBuffer=0x2388438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2388438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.716] ReadFile (in: hFile=0x23c, lpBuffer=0x2388438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2388438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.716] ReadFile (in: hFile=0x23c, lpBuffer=0x2388438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2388438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0131.716] ReadFile (in: hFile=0x23c, lpBuffer=0x2388438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2388438*, lpNumberOfBytesRead=0x2edf68*=0x6a8, lpOverlapped=0x0) returned 1 [0131.717] ReadFile (in: hFile=0x23c, lpBuffer=0x23882c8, nNumberOfBytesToRead=0x158, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23882c8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0131.717] ReadFile (in: hFile=0x23c, lpBuffer=0x2388438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2388438*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0131.717] CloseHandle (hObject=0x23c) returned 1 [0131.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a", lpFilePart=0x0) returned 0x33 [0131.718] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\KutKRhb6a.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\kutkrhb6a.m4a")) returned 1 [0131.719] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", lpFilePart=0x0) returned 0x3d [0131.719] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", dwFileAttributes=0x80) returned 1 [0131.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi.Horsuke", lpFilePart=0x0) returned 0x45 [0131.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0131.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pk0fxuqzus50endcqys.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0131.721] GetFileType (hFile=0x15c) returned 0x1 [0131.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0131.721] GetFileType (hFile=0x15c) returned 0x1 [0132.245] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", lpFilePart=0x0) returned 0x3d [0132.245] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0132.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pk0fxuqzus50endcqys.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0132.246] GetFileType (hFile=0x23c) returned 0x1 [0132.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0132.246] GetFileType (hFile=0x23c) returned 0x1 [0132.246] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.248] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.251] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.251] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.252] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.252] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.252] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.252] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.253] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.253] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x59a, lpOverlapped=0x0) returned 1 [0132.253] ReadFile (in: hFile=0x23c, lpBuffer=0x22723ba, nNumberOfBytesToRead=0x266, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22723ba*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0132.253] ReadFile (in: hFile=0x23c, lpBuffer=0x2272638, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2272638*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0132.253] CloseHandle (hObject=0x23c) returned 1 [0132.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi", lpFilePart=0x0) returned 0x3d [0132.254] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\PK0FxUQzUs50eNdcqYS.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\pk0fxuqzus50endcqys.avi")) returned 1 [0132.255] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", lpFilePart=0x0) returned 0x2f [0132.255] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", dwFileAttributes=0x80) returned 1 [0132.256] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi.Horsuke", lpFilePart=0x0) returned 0x37 [0132.256] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0132.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qovej.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0132.257] GetFileType (hFile=0x15c) returned 0x1 [0132.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0132.257] GetFileType (hFile=0x15c) returned 0x1 [0132.916] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", lpFilePart=0x0) returned 0x2f [0132.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0132.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qovej.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0132.917] GetFileType (hFile=0x23c) returned 0x1 [0132.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0132.917] GetFileType (hFile=0x23c) returned 0x1 [0132.917] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.922] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.922] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.923] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.923] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.923] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.923] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.923] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.924] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.924] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.924] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.924] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.924] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0132.925] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0xe88, lpOverlapped=0x0) returned 1 [0132.925] ReadFile (in: hFile=0x23c, lpBuffer=0x23369e0, nNumberOfBytesToRead=0x178, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23369e0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0132.925] ReadFile (in: hFile=0x23c, lpBuffer=0x2336b70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336b70*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0132.925] CloseHandle (hObject=0x23c) returned 1 [0132.954] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi", lpFilePart=0x0) returned 0x2f [0132.954] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\QovEj.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\qovej.avi")) returned 1 [0132.956] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", lpFilePart=0x0) returned 0x32 [0132.956] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", dwFileAttributes=0x80) returned 1 [0132.957] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt.Horsuke", lpFilePart=0x0) returned 0x3a [0132.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0132.957] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wfu9j1eg.odt.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0132.959] GetFileType (hFile=0x15c) returned 0x1 [0132.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0132.959] GetFileType (hFile=0x15c) returned 0x1 [0133.793] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", lpFilePart=0x0) returned 0x32 [0133.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0133.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wfu9j1eg.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0133.794] GetFileType (hFile=0x23c) returned 0x1 [0133.794] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0133.795] GetFileType (hFile=0x23c) returned 0x1 [0133.795] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.801] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.802] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.802] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.802] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.803] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.803] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.803] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.803] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.804] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.804] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.804] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.805] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.805] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.805] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0133.806] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0xddd, lpOverlapped=0x0) returned 1 [0133.806] ReadFile (in: hFile=0x23c, lpBuffer=0x222d635, nNumberOfBytesToRead=0x223, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d635*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0133.806] ReadFile (in: hFile=0x23c, lpBuffer=0x222d870, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d870*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0133.806] CloseHandle (hObject=0x23c) returned 1 [0133.807] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt", lpFilePart=0x0) returned 0x32 [0133.807] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\wfU9j1Eg.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wfu9j1eg.odt")) returned 1 [0133.809] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", lpFilePart=0x0) returned 0x3e [0133.809] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", dwFileAttributes=0x80) returned 1 [0133.811] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a.Horsuke", lpFilePart=0x0) returned 0x46 [0133.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0133.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xt-zgmrjaarjsivgguzm.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0133.830] GetFileType (hFile=0x15c) returned 0x1 [0133.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0133.830] GetFileType (hFile=0x15c) returned 0x1 [0134.619] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", lpFilePart=0x0) returned 0x3e [0134.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0134.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xt-zgmrjaarjsivgguzm.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0134.620] GetFileType (hFile=0x23c) returned 0x1 [0134.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0134.620] GetFileType (hFile=0x23c) returned 0x1 [0134.620] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.626] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.628] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.628] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.628] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.629] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.629] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.629] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.629] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.630] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.630] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.630] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.631] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.631] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.631] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.631] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.632] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.632] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.632] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.632] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0134.633] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x132, lpOverlapped=0x0) returned 1 [0134.633] ReadFile (in: hFile=0x23c, lpBuffer=0x23264e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23264e0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0134.633] CloseHandle (hObject=0x23c) returned 1 [0134.634] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a", lpFilePart=0x0) returned 0x3e [0134.634] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Xt-ZGmrJAArjSIvggUZm.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\xt-zgmrjaarjsivgguzm.m4a")) returned 1 [0134.636] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", lpFilePart=0x0) returned 0x35 [0134.636] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", dwFileAttributes=0x80) returned 1 [0134.637] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png.Horsuke", lpFilePart=0x0) returned 0x3d [0134.637] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0134.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zlzpf29by_y.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0134.639] GetFileType (hFile=0x15c) returned 0x1 [0134.639] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0134.639] GetFileType (hFile=0x15c) returned 0x1 [0135.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", lpFilePart=0x0) returned 0x35 [0135.250] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0135.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zlzpf29by_y.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0135.251] GetFileType (hFile=0x23c) returned 0x1 [0135.251] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0135.251] GetFileType (hFile=0x23c) returned 0x1 [0135.251] ReadFile (in: hFile=0x23c, lpBuffer=0x2423578, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2423578*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.261] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.261] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.261] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.262] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.262] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.262] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.263] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.263] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.263] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.264] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.264] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.264] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.264] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.265] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.265] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.265] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.265] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0135.266] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x7e, lpOverlapped=0x0) returned 1 [0135.266] ReadFile (in: hFile=0x23c, lpBuffer=0x2225438, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2225438*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0135.266] CloseHandle (hObject=0x23c) returned 1 [0135.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png", lpFilePart=0x0) returned 0x35 [0135.267] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\ZlzpF29bY_Y.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\zlzpf29by_y.png")) returned 1 [0135.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0135.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj", lpFilePart=0x0) returned 0x3a [0135.269] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\", lpFilePart=0x0) returned 0x3b [0135.269] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0135.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.270] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.270] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0135.270] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0135.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0135.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0135.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0135.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj", lpFilePart=0x0) returned 0x3a [0135.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\", lpFilePart=0x0) returned 0x3b [0135.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0135.270] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.270] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.270] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.271] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0135.271] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0135.271] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0135.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0135.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0135.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", lpFilePart=0x0) returned 0x4f [0135.271] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", dwFileAttributes=0x80) returned 1 [0135.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc.Horsuke", lpFilePart=0x0) returned 0x57 [0135.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0135.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\7jvapb-4eai5xhxn.doc.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0135.273] GetFileType (hFile=0x15c) returned 0x1 [0135.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0135.274] GetFileType (hFile=0x15c) returned 0x1 [0135.943] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", lpFilePart=0x0) returned 0x4f [0135.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0135.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\7jvapb-4eai5xhxn.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0135.943] GetFileType (hFile=0x23c) returned 0x1 [0135.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0135.944] GetFileType (hFile=0x23c) returned 0x1 [0135.944] ReadFile (in: hFile=0x23c, lpBuffer=0x23223b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23223b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0135.950] ReadFile (in: hFile=0x23c, lpBuffer=0x23223b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23223b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0135.950] ReadFile (in: hFile=0x23c, lpBuffer=0x23223b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23223b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0135.950] ReadFile (in: hFile=0x23c, lpBuffer=0x23223b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23223b8*, lpNumberOfBytesRead=0x2edee8*=0x323, lpOverlapped=0x0) returned 1 [0135.951] ReadFile (in: hFile=0x23c, lpBuffer=0x23223b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23223b8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0135.951] CloseHandle (hObject=0x23c) returned 1 [0135.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc", lpFilePart=0x0) returned 0x4f [0135.951] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\7JvAPb-4EaI5xhXn.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\7jvapb-4eai5xhxn.doc")) returned 1 [0135.952] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", lpFilePart=0x0) returned 0x4e [0135.952] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", dwFileAttributes=0x80) returned 1 [0135.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv.Horsuke", lpFilePart=0x0) returned 0x56 [0135.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0135.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\sjconhpgo7ogw1a.csv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0135.955] GetFileType (hFile=0x15c) returned 0x1 [0135.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0135.955] GetFileType (hFile=0x15c) returned 0x1 [0136.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", lpFilePart=0x0) returned 0x4e [0136.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0136.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\sjconhpgo7ogw1a.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0136.875] GetFileType (hFile=0x23c) returned 0x1 [0136.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0136.875] GetFileType (hFile=0x23c) returned 0x1 [0136.875] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.881] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.882] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.882] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.882] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.883] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.883] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.883] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.884] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.884] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.884] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.885] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.885] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.885] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.886] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.887] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.887] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0136.888] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0xf87, lpOverlapped=0x0) returned 1 [0136.888] ReadFile (in: hFile=0x23c, lpBuffer=0x240e06f, nNumberOfBytesToRead=0x79, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e06f*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0136.888] ReadFile (in: hFile=0x23c, lpBuffer=0x240e100, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x240e100*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0136.888] CloseHandle (hObject=0x23c) returned 1 [0136.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv", lpFilePart=0x0) returned 0x4e [0136.889] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\SjConhPgO7OGW1a.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\sjconhpgo7ogw1a.csv")) returned 1 [0136.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", lpFilePart=0x0) returned 0x43 [0136.892] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", dwFileAttributes=0x80) returned 1 [0136.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg.Horsuke", lpFilePart=0x0) returned 0x4b [0136.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0136.893] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\t0g_.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0136.895] GetFileType (hFile=0x15c) returned 0x1 [0136.895] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0136.895] GetFileType (hFile=0x15c) returned 0x1 [0137.910] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", lpFilePart=0x0) returned 0x43 [0137.910] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0137.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\t0g_.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0137.911] GetFileType (hFile=0x23c) returned 0x1 [0137.911] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0137.911] GetFileType (hFile=0x23c) returned 0x1 [0137.911] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.916] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.917] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.917] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.917] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.917] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.917] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.918] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.918] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.918] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.918] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.919] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0137.919] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x7de, lpOverlapped=0x0) returned 1 [0137.919] ReadFile (in: hFile=0x23c, lpBuffer=0x2308fee, nNumberOfBytesToRead=0x22, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2308fee*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0137.919] ReadFile (in: hFile=0x23c, lpBuffer=0x2309028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2309028*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0137.919] CloseHandle (hObject=0x23c) returned 1 [0137.919] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg", lpFilePart=0x0) returned 0x43 [0137.919] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\T0G_.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\t0g_.jpg")) returned 1 [0137.923] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.TXT", lpFilePart=0x0) returned 0x43 [0137.923] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0137.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0137.924] GetFileType (hFile=0x15c) returned 0x1 [0137.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0137.924] GetFileType (hFile=0x15c) returned 0x1 [0137.925] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.png", lpFilePart=0x0) returned 0x43 [0137.925] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0137.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0137.926] GetFileType (hFile=0x15c) returned 0x1 [0137.926] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0137.926] GetFileType (hFile=0x15c) returned 0x1 [0137.926] WriteFile (in: hFile=0x15c, lpBuffer=0x2321168*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2321168*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0137.927] CloseHandle (hObject=0x15c) returned 1 [0137.927] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.vbs", lpFilePart=0x0) returned 0x43 [0137.927] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0137.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0137.928] GetFileType (hFile=0x15c) returned 0x1 [0137.928] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0137.928] GetFileType (hFile=0x15c) returned 0x1 [0137.929] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6f [0137.929] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0137.929] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NPlF_K3amBfmHrhJ3Rcj\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nplf_k3ambfmhrhj3rcj\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0137.929] GetFileType (hFile=0x15c) returned 0x1 [0137.929] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0137.929] GetFileType (hFile=0x15c) returned 0x1 [0137.930] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0137.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW", lpFilePart=0x0) returned 0x38 [0137.930] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\", lpFilePart=0x0) returned 0x39 [0137.930] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0137.930] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.931] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.931] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.931] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.931] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0137.931] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0137.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0137.931] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0137.931] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0137.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW", lpFilePart=0x0) returned 0x38 [0137.931] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\", lpFilePart=0x0) returned 0x39 [0137.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0137.931] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0137.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0137.932] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0137.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0137.932] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0137.932] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", lpFilePart=0x0) returned 0x50 [0137.932] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", dwFileAttributes=0x80) returned 1 [0137.933] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png.Horsuke", lpFilePart=0x0) returned 0x58 [0137.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0137.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\kupbt2fgejp6fq xrht.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0137.934] GetFileType (hFile=0x15c) returned 0x1 [0137.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0137.934] GetFileType (hFile=0x15c) returned 0x1 [0138.813] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", lpFilePart=0x0) returned 0x50 [0138.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0138.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\kupbt2fgejp6fq xrht.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0138.814] GetFileType (hFile=0x23c) returned 0x1 [0138.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0138.814] GetFileType (hFile=0x23c) returned 0x1 [0138.814] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.822] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.822] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.822] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.823] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.823] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.823] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.827] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.827] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.827] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.828] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.828] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0138.828] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0xb54, lpOverlapped=0x0) returned 1 [0138.828] ReadFile (in: hFile=0x23c, lpBuffer=0x241339c, nNumberOfBytesToRead=0xac, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x241339c*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0138.828] ReadFile (in: hFile=0x23c, lpBuffer=0x2413460, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2413460*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0138.829] CloseHandle (hObject=0x23c) returned 1 [0138.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png", lpFilePart=0x0) returned 0x50 [0138.829] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\kUpbT2FGejp6fq xRht.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\kupbt2fgejp6fq xrht.png")) returned 1 [0138.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", lpFilePart=0x0) returned 0x4d [0138.831] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", dwFileAttributes=0x80) returned 1 [0138.832] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4.Horsuke", lpFilePart=0x0) returned 0x55 [0138.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0138.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\zogyivsimfyhbrxt.mp4.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0138.833] GetFileType (hFile=0x15c) returned 0x1 [0138.833] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0138.833] GetFileType (hFile=0x15c) returned 0x1 [0139.690] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", lpFilePart=0x0) returned 0x4d [0139.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0139.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\zogyivsimfyhbrxt.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0139.692] GetFileType (hFile=0x23c) returned 0x1 [0139.692] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0139.692] GetFileType (hFile=0x23c) returned 0x1 [0139.692] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.699] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.700] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.700] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.700] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.702] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.702] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.706] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.706] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.706] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.707] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0139.707] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0xd4c, lpOverlapped=0x0) returned 1 [0139.707] ReadFile (in: hFile=0x23c, lpBuffer=0x2310e44, nNumberOfBytesToRead=0x2b4, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2310e44*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0139.707] ReadFile (in: hFile=0x23c, lpBuffer=0x2311110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2311110*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0139.707] CloseHandle (hObject=0x23c) returned 1 [0139.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4", lpFilePart=0x0) returned 0x4d [0139.708] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\ZoGyiVSiMfyhbrxt.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\zogyivsimfyhbrxt.mp4")) returned 1 [0139.710] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0139.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL", lpFilePart=0x0) returned 0x4a [0139.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\", lpFilePart=0x0) returned 0x4b [0139.710] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0139.710] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.710] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.711] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.712] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0139.712] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0139.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0139.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0139.712] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0139.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL", lpFilePart=0x0) returned 0x4a [0139.712] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\", lpFilePart=0x0) returned 0x4b [0139.712] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0139.712] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.712] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.713] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0139.714] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0139.714] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0139.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0139.714] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0139.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", lpFilePart=0x0) returned 0x62 [0139.714] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", dwFileAttributes=0x80) returned 1 [0139.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png.Horsuke", lpFilePart=0x0) returned 0x6a [0139.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0139.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\1o0 xthkf7wnbep1-tk.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0139.716] GetFileType (hFile=0x15c) returned 0x1 [0139.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0139.716] GetFileType (hFile=0x15c) returned 0x1 [0140.301] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", lpFilePart=0x0) returned 0x62 [0140.302] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0140.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\1o0 xthkf7wnbep1-tk.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0140.302] GetFileType (hFile=0x23c) returned 0x1 [0140.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0140.302] GetFileType (hFile=0x23c) returned 0x1 [0140.302] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.308] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.308] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.309] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.309] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.309] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.309] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.310] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.310] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.310] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.310] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.310] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.311] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.311] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.311] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.311] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.311] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.312] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.312] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.312] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.312] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.312] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x290, lpOverlapped=0x0) returned 1 [0140.313] ReadFile (in: hFile=0x23c, lpBuffer=0x2418818, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2418818*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0140.313] CloseHandle (hObject=0x23c) returned 1 [0140.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png", lpFilePart=0x0) returned 0x62 [0140.313] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\1O0 XTHkF7wnBeP1-tK.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\1o0 xthkf7wnbep1-tk.png")) returned 1 [0140.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", lpFilePart=0x0) returned 0x63 [0140.315] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", dwFileAttributes=0x80) returned 1 [0140.316] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt.Horsuke", lpFilePart=0x0) returned 0x6b [0140.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0140.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\na337b-g7yii3zwe6q4s.odt.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0140.317] GetFileType (hFile=0x15c) returned 0x1 [0140.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0140.317] GetFileType (hFile=0x15c) returned 0x1 [0140.817] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", lpFilePart=0x0) returned 0x63 [0140.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0140.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\na337b-g7yii3zwe6q4s.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0140.818] GetFileType (hFile=0x23c) returned 0x1 [0140.818] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0140.818] GetFileType (hFile=0x23c) returned 0x1 [0140.818] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.823] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.823] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.824] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.825] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0140.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0xa9b, lpOverlapped=0x0) returned 1 [0140.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2316bf3, nNumberOfBytesToRead=0x165, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316bf3*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0140.826] ReadFile (in: hFile=0x23c, lpBuffer=0x2316d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2316d70*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0140.826] CloseHandle (hObject=0x23c) returned 1 [0140.827] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt", lpFilePart=0x0) returned 0x63 [0140.827] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\NA337B-G7YiI3zwE6q4S.odt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\na337b-g7yii3zwe6q4s.odt")) returned 1 [0140.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", lpFilePart=0x0) returned 0x53 [0140.828] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", dwFileAttributes=0x80) returned 1 [0140.829] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a.Horsuke", lpFilePart=0x0) returned 0x5b [0140.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0140.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\stti.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0140.830] GetFileType (hFile=0x15c) returned 0x1 [0140.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0140.830] GetFileType (hFile=0x15c) returned 0x1 [0141.318] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", lpFilePart=0x0) returned 0x53 [0141.318] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0141.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\stti.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0141.319] GetFileType (hFile=0x23c) returned 0x1 [0141.319] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0141.319] GetFileType (hFile=0x23c) returned 0x1 [0141.319] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.324] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.324] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.325] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.325] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.325] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.325] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.325] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.326] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.326] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.326] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.326] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.326] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.327] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.327] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x61a, lpOverlapped=0x0) returned 1 [0141.327] ReadFile (in: hFile=0x23c, lpBuffer=0x240e4aa, nNumberOfBytesToRead=0x1e6, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e4aa*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0141.327] ReadFile (in: hFile=0x23c, lpBuffer=0x240e6a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x240e6a8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0141.327] CloseHandle (hObject=0x23c) returned 1 [0141.327] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a", lpFilePart=0x0) returned 0x53 [0141.327] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Stti.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\stti.m4a")) returned 1 [0141.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", lpFilePart=0x0) returned 0x61 [0141.328] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", dwFileAttributes=0x80) returned 1 [0141.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi.Horsuke", lpFilePart=0x0) returned 0x69 [0141.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0141.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\y4bhw3ylfwlw9lrbf9.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0141.330] GetFileType (hFile=0x15c) returned 0x1 [0141.330] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0141.330] GetFileType (hFile=0x15c) returned 0x1 [0141.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", lpFilePart=0x0) returned 0x61 [0141.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0141.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\y4bhw3ylfwlw9lrbf9.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0141.843] GetFileType (hFile=0x23c) returned 0x1 [0141.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0141.843] GetFileType (hFile=0x23c) returned 0x1 [0141.843] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.848] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.848] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.849] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.849] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.849] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.850] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.850] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.850] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.850] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.851] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.851] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.851] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.851] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.851] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.852] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.852] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.852] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.852] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.852] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0141.853] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x6be, lpOverlapped=0x0) returned 1 [0141.853] ReadFile (in: hFile=0x23c, lpBuffer=0x2305b66, nNumberOfBytesToRead=0x142, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305b66*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0141.853] ReadFile (in: hFile=0x23c, lpBuffer=0x2305cc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2305cc0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0141.853] CloseHandle (hObject=0x23c) returned 1 [0141.853] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi", lpFilePart=0x0) returned 0x61 [0141.853] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Y4Bhw3YLfwLw9LRbf9.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\y4bhw3ylfwlw9lrbf9.avi")) returned 1 [0141.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0141.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc", lpFilePart=0x0) returned 0x51 [0141.854] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\", lpFilePart=0x0) returned 0x52 [0141.855] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0141.855] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.855] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.855] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.855] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.855] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0141.855] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0141.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0141.855] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0141.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0141.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc", lpFilePart=0x0) returned 0x51 [0141.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\", lpFilePart=0x0) returned 0x52 [0141.856] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0141.856] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.856] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.856] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.856] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0141.856] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0141.856] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0141.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0141.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0141.856] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", lpFilePart=0x0) returned 0x63 [0141.857] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", dwFileAttributes=0x80) returned 1 [0141.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv.Horsuke", lpFilePart=0x0) returned 0x6b [0141.857] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0141.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\iuwroheo4zet-.csv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0141.858] GetFileType (hFile=0x15c) returned 0x1 [0141.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0141.858] GetFileType (hFile=0x15c) returned 0x1 [0142.362] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", lpFilePart=0x0) returned 0x63 [0142.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0142.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\iuwroheo4zet-.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0142.363] GetFileType (hFile=0x23c) returned 0x1 [0142.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0142.363] GetFileType (hFile=0x23c) returned 0x1 [0142.363] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.368] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.368] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.368] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.368] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.369] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.369] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.369] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.369] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.370] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.370] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.370] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.370] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.370] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.371] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.371] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.371] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.371] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.371] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x510, lpOverlapped=0x0) returned 1 [0142.372] ReadFile (in: hFile=0x23c, lpBuffer=0x2406ec8, nNumberOfBytesToRead=0x2f0, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2406ec8*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0142.372] ReadFile (in: hFile=0x23c, lpBuffer=0x24071d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x24071d0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0142.372] CloseHandle (hObject=0x23c) returned 1 [0142.372] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv", lpFilePart=0x0) returned 0x63 [0142.372] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\iUWRoheo4ZET-.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\iuwroheo4zet-.csv")) returned 1 [0142.373] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", lpFilePart=0x0) returned 0x63 [0142.373] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", dwFileAttributes=0x80) returned 1 [0142.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv.Horsuke", lpFilePart=0x0) returned 0x6b [0142.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0142.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\ncrezxhcpay7t.csv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0142.375] GetFileType (hFile=0x15c) returned 0x1 [0142.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0142.375] GetFileType (hFile=0x15c) returned 0x1 [0142.926] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", lpFilePart=0x0) returned 0x63 [0142.926] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0142.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\ncrezxhcpay7t.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0142.927] GetFileType (hFile=0x23c) returned 0x1 [0142.927] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0142.927] GetFileType (hFile=0x23c) returned 0x1 [0142.927] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.932] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.932] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.932] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.932] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.934] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0142.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0xa3b, lpOverlapped=0x0) returned 1 [0142.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22e3fa3, nNumberOfBytesToRead=0x1c5, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e3fa3*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0142.935] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4180, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22e4180*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0142.935] CloseHandle (hObject=0x23c) returned 1 [0142.935] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv", lpFilePart=0x0) returned 0x63 [0142.935] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\nCREzxHCpay7T.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\ncrezxhcpay7t.csv")) returned 1 [0142.939] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.TXT", lpFilePart=0x0) returned 0x5a [0142.939] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0142.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.940] GetFileType (hFile=0x15c) returned 0x1 [0142.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0142.940] GetFileType (hFile=0x15c) returned 0x1 [0142.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.png", lpFilePart=0x0) returned 0x5a [0142.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0142.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0142.941] GetFileType (hFile=0x15c) returned 0x1 [0142.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0142.942] GetFileType (hFile=0x15c) returned 0x1 [0142.942] WriteFile (in: hFile=0x15c, lpBuffer=0x2300788*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2300788*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0142.942] CloseHandle (hObject=0x15c) returned 1 [0142.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.vbs", lpFilePart=0x0) returned 0x5a [0142.943] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0142.943] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.943] GetFileType (hFile=0x15c) returned 0x1 [0142.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0142.943] GetFileType (hFile=0x15c) returned 0x1 [0142.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x86 [0142.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0142.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\xagKXc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\xagkxc\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.944] GetFileType (hFile=0x15c) returned 0x1 [0142.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0142.944] GetFileType (hFile=0x15c) returned 0x1 [0142.945] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.TXT", lpFilePart=0x0) returned 0x53 [0142.945] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0142.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.946] GetFileType (hFile=0x15c) returned 0x1 [0142.946] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0142.946] GetFileType (hFile=0x15c) returned 0x1 [0142.946] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.png", lpFilePart=0x0) returned 0x53 [0142.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0142.946] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0142.947] GetFileType (hFile=0x15c) returned 0x1 [0142.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0142.947] GetFileType (hFile=0x15c) returned 0x1 [0142.947] WriteFile (in: hFile=0x15c, lpBuffer=0x2312238*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2312238*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0142.948] CloseHandle (hObject=0x15c) returned 1 [0142.948] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.vbs", lpFilePart=0x0) returned 0x53 [0142.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0142.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.948] GetFileType (hFile=0x15c) returned 0x1 [0142.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0142.948] GetFileType (hFile=0x15c) returned 0x1 [0142.949] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7f [0142.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0142.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\bL1MLuSfRW2hgDcCL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\bl1mlusfrw2hgdccl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.950] GetFileType (hFile=0x15c) returned 0x1 [0142.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0142.950] GetFileType (hFile=0x15c) returned 0x1 [0142.951] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0142.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0142.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.952] GetFileType (hFile=0x15c) returned 0x1 [0142.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0142.952] GetFileType (hFile=0x15c) returned 0x1 [0142.953] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.png", lpFilePart=0x0) returned 0x41 [0142.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0142.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0142.954] GetFileType (hFile=0x15c) returned 0x1 [0142.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0142.954] GetFileType (hFile=0x15c) returned 0x1 [0142.954] WriteFile (in: hFile=0x15c, lpBuffer=0x2323c38*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2323c38*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0142.955] CloseHandle (hObject=0x15c) returned 1 [0142.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0142.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0142.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.956] GetFileType (hFile=0x15c) returned 0x1 [0142.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0142.956] GetFileType (hFile=0x15c) returned 0x1 [0142.964] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0142.964] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0142.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\NrU0XkGaysCB2d -pW\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\nru0xkgayscb2d -pw\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.965] GetFileType (hFile=0x15c) returned 0x1 [0142.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0142.965] GetFileType (hFile=0x15c) returned 0x1 [0142.966] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0142.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0142.966] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.967] GetFileType (hFile=0x15c) returned 0x1 [0142.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0142.967] GetFileType (hFile=0x15c) returned 0x1 [0142.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.png", lpFilePart=0x0) returned 0x2e [0142.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0142.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0142.969] GetFileType (hFile=0x15c) returned 0x1 [0142.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0142.969] GetFileType (hFile=0x15c) returned 0x1 [0142.969] WriteFile (in: hFile=0x15c, lpBuffer=0x2335520*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2335520*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0142.970] CloseHandle (hObject=0x15c) returned 1 [0142.970] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0142.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0142.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.971] GetFileType (hFile=0x15c) returned 0x1 [0142.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0142.971] GetFileType (hFile=0x15c) returned 0x1 [0142.972] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0142.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0142.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0142.972] GetFileType (hFile=0x15c) returned 0x1 [0142.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0142.972] GetFileType (hFile=0x15c) returned 0x1 [0142.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0142.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0142.973] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0142.973] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.974] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.975] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.976] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.977] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.978] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.979] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0142.979] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0142.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0142.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0142.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0142.979] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents", lpFilePart=0x0) returned 0x27 [0142.980] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\", lpFilePart=0x0) returned 0x28 [0142.980] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0142.980] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.980] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.980] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.980] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.980] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.980] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.984] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0142.985] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0142.985] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0142.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0142.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0142.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", lpFilePart=0x0) returned 0x3d [0142.986] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", dwFileAttributes=0x80) returned 1 [0142.986] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx.Horsuke", lpFilePart=0x0) returned 0x45 [0142.986] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0142.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-fehl-u5v6jwxqyp.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0142.987] GetFileType (hFile=0x15c) returned 0x1 [0142.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0142.987] GetFileType (hFile=0x15c) returned 0x1 [0143.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", lpFilePart=0x0) returned 0x3d [0143.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0143.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-fehl-u5v6jwxqyp.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0143.594] GetFileType (hFile=0x23c) returned 0x1 [0143.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0143.594] GetFileType (hFile=0x23c) returned 0x1 [0143.594] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0143.599] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0143.599] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0143.599] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0143.599] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0143.600] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x9d4, lpOverlapped=0x0) returned 1 [0143.600] ReadFile (in: hFile=0x23c, lpBuffer=0x22341ac, nNumberOfBytesToRead=0x22c, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22341ac*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0143.600] ReadFile (in: hFile=0x23c, lpBuffer=0x22343f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22343f0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0143.600] CloseHandle (hObject=0x23c) returned 1 [0143.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx", lpFilePart=0x0) returned 0x3d [0143.600] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-fEHl-U5V6jWxqyp.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-fehl-u5v6jwxqyp.pptx")) returned 1 [0143.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", lpFilePart=0x0) returned 0x37 [0143.602] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", dwFileAttributes=0x80) returned 1 [0143.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods.Horsuke", lpFilePart=0x0) returned 0x3f [0143.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0143.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-hq4z5tordr.ods.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0143.604] GetFileType (hFile=0x15c) returned 0x1 [0143.604] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0143.604] GetFileType (hFile=0x15c) returned 0x1 [0144.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", lpFilePart=0x0) returned 0x37 [0144.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0144.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-hq4z5tordr.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0144.107] GetFileType (hFile=0x23c) returned 0x1 [0144.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0144.107] GetFileType (hFile=0x23c) returned 0x1 [0144.107] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.112] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.113] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.113] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.113] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.113] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.113] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.114] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.114] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.114] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.114] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.114] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.115] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.115] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.115] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.115] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.115] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x699, lpOverlapped=0x0) returned 1 [0144.116] ReadFile (in: hFile=0x23c, lpBuffer=0x2322631, nNumberOfBytesToRead=0x167, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2322631*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0144.116] ReadFile (in: hFile=0x23c, lpBuffer=0x23227b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23227b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0144.116] CloseHandle (hObject=0x23c) returned 1 [0144.116] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods", lpFilePart=0x0) returned 0x37 [0144.116] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\-HQ4Z5ToRdr.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\-hq4z5tordr.ods")) returned 1 [0144.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", lpFilePart=0x0) returned 0x31 [0144.118] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", dwFileAttributes=0x80) returned 1 [0144.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc.Horsuke", lpFilePart=0x0) returned 0x39 [0144.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0144.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0dqy6.doc.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0144.281] GetFileType (hFile=0x15c) returned 0x1 [0144.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0144.282] GetFileType (hFile=0x15c) returned 0x1 [0144.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", lpFilePart=0x0) returned 0x31 [0144.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0144.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0dqy6.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0144.752] GetFileType (hFile=0x23c) returned 0x1 [0144.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0144.752] GetFileType (hFile=0x23c) returned 0x1 [0144.752] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.754] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.758] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.758] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.758] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.758] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.758] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.759] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.759] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.759] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.759] ReadFile (in: hFile=0x23c, lpBuffer=0x241bbe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241bbe8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.761] ReadFile (in: hFile=0x23c, lpBuffer=0x2228878, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2228878*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.761] ReadFile (in: hFile=0x23c, lpBuffer=0x2228878, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2228878*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0144.761] ReadFile (in: hFile=0x23c, lpBuffer=0x2228878, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2228878*, lpNumberOfBytesRead=0x2edf68*=0x720, lpOverlapped=0x0) returned 1 [0144.762] ReadFile (in: hFile=0x23c, lpBuffer=0x2228780, nNumberOfBytesToRead=0xe0, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2228780*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0144.762] ReadFile (in: hFile=0x23c, lpBuffer=0x2228878, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2228878*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0144.762] CloseHandle (hObject=0x23c) returned 1 [0144.762] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc", lpFilePart=0x0) returned 0x31 [0144.762] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0DqY6.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0dqy6.doc")) returned 1 [0144.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", lpFilePart=0x0) returned 0x38 [0144.764] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", dwFileAttributes=0x80) returned 1 [0144.764] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx.Horsuke", lpFilePart=0x0) returned 0x40 [0144.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0144.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0txlzsthro9.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0144.765] GetFileType (hFile=0x15c) returned 0x1 [0144.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0144.765] GetFileType (hFile=0x15c) returned 0x1 [0145.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", lpFilePart=0x0) returned 0x38 [0145.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0145.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0txlzsthro9.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0145.252] GetFileType (hFile=0x23c) returned 0x1 [0145.252] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0145.252] GetFileType (hFile=0x23c) returned 0x1 [0145.252] ReadFile (in: hFile=0x23c, lpBuffer=0x23137f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23137f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.257] ReadFile (in: hFile=0x23c, lpBuffer=0x23137f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23137f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.257] ReadFile (in: hFile=0x23c, lpBuffer=0x23137f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23137f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.258] ReadFile (in: hFile=0x23c, lpBuffer=0x23137f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23137f0*, lpNumberOfBytesRead=0x2edf68*=0x5fa, lpOverlapped=0x0) returned 1 [0145.258] ReadFile (in: hFile=0x23c, lpBuffer=0x23135d2, nNumberOfBytesToRead=0x206, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23135d2*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0145.258] ReadFile (in: hFile=0x23c, lpBuffer=0x23137f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23137f0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0145.258] CloseHandle (hObject=0x23c) returned 1 [0145.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx", lpFilePart=0x0) returned 0x38 [0145.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\0txlzsTHrO9.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\0txlzsthro9.pptx")) returned 1 [0145.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", lpFilePart=0x0) returned 0x41 [0145.259] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", dwFileAttributes=0x80) returned 1 [0145.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx.Horsuke", lpFilePart=0x0) returned 0x49 [0145.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0145.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1r0ttoqprego1sjypuih.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0145.261] GetFileType (hFile=0x15c) returned 0x1 [0145.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0145.261] GetFileType (hFile=0x15c) returned 0x1 [0145.720] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", lpFilePart=0x0) returned 0x41 [0145.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0145.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1r0ttoqprego1sjypuih.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0145.721] GetFileType (hFile=0x23c) returned 0x1 [0145.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0145.721] GetFileType (hFile=0x23c) returned 0x1 [0145.721] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.726] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.727] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.727] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.727] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.728] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.728] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.728] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.728] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.728] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.729] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.729] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.729] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.729] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.729] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.730] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.730] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.730] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0145.730] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0xce1, lpOverlapped=0x0) returned 1 [0145.730] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff491, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff491*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0145.731] ReadFile (in: hFile=0x23c, lpBuffer=0x23ff7c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ff7c8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0145.731] CloseHandle (hObject=0x23c) returned 1 [0145.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx", lpFilePart=0x0) returned 0x41 [0145.731] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\1R0ttOqPreGO1SjYPUiH.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\1r0ttoqprego1sjypuih.xlsx")) returned 1 [0145.732] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", lpFilePart=0x0) returned 0x3d [0145.732] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", dwFileAttributes=0x80) returned 1 [0145.733] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx.Horsuke", lpFilePart=0x0) returned 0x45 [0145.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0145.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3n9omjmve4mqgjg3.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0145.734] GetFileType (hFile=0x15c) returned 0x1 [0145.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0145.734] GetFileType (hFile=0x15c) returned 0x1 [0146.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", lpFilePart=0x0) returned 0x3d [0146.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0146.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3n9omjmve4mqgjg3.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0146.229] GetFileType (hFile=0x23c) returned 0x1 [0146.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0146.229] GetFileType (hFile=0x23c) returned 0x1 [0146.229] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.234] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.235] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.235] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.235] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.235] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.236] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.236] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.236] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.236] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.236] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.237] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.237] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.237] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.237] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.237] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.238] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.238] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.238] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.238] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.238] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.239] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x96b, lpOverlapped=0x0) returned 1 [0146.239] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb1e3, nNumberOfBytesToRead=0x295, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb1e3*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0146.239] ReadFile (in: hFile=0x23c, lpBuffer=0x22fb490, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fb490*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0146.239] CloseHandle (hObject=0x23c) returned 1 [0146.239] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx", lpFilePart=0x0) returned 0x3d [0146.239] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\3N9omjMve4MqgJG3.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\3n9omjmve4mqgjg3.xlsx")) returned 1 [0146.241] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", lpFilePart=0x0) returned 0x35 [0146.241] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", dwFileAttributes=0x80) returned 1 [0146.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf.Horsuke", lpFilePart=0x0) returned 0x3d [0146.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0146.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5 fdhdz1.rtf.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0146.242] GetFileType (hFile=0x15c) returned 0x1 [0146.243] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0146.243] GetFileType (hFile=0x15c) returned 0x1 [0146.698] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", lpFilePart=0x0) returned 0x35 [0146.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0146.698] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5 fdhdz1.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0146.698] GetFileType (hFile=0x23c) returned 0x1 [0146.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0146.698] GetFileType (hFile=0x23c) returned 0x1 [0146.698] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.704] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.705] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.705] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.705] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.705] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.706] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.706] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.706] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.706] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.706] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.707] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.707] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.707] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.707] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.707] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.708] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.708] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.708] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0146.708] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0xd6e, lpOverlapped=0x0) returned 1 [0146.708] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9b16, nNumberOfBytesToRead=0x292, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9b16*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0146.709] ReadFile (in: hFile=0x23c, lpBuffer=0x23f9dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f9dc0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0146.709] CloseHandle (hObject=0x23c) returned 1 [0146.709] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf", lpFilePart=0x0) returned 0x35 [0146.709] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5 fDHDZ1.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5 fdhdz1.rtf")) returned 1 [0146.710] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", lpFilePart=0x0) returned 0x41 [0146.711] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", dwFileAttributes=0x80) returned 1 [0146.711] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx.Horsuke", lpFilePart=0x0) returned 0x49 [0146.711] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0146.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aas3v4mtkmtk4czqfxd.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0146.712] GetFileType (hFile=0x15c) returned 0x1 [0146.712] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0146.712] GetFileType (hFile=0x15c) returned 0x1 [0147.165] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", lpFilePart=0x0) returned 0x41 [0147.166] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0147.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aas3v4mtkmtk4czqfxd.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0147.166] GetFileType (hFile=0x23c) returned 0x1 [0147.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0147.166] GetFileType (hFile=0x23c) returned 0x1 [0147.166] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.171] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.172] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.172] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.172] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.172] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.173] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.173] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.173] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.173] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.173] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.174] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.175] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.175] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.175] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.175] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.176] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.176] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.176] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0xf5, lpOverlapped=0x0) returned 1 [0147.176] ReadFile (in: hFile=0x23c, lpBuffer=0x22fbd90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22fbd90*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0147.176] CloseHandle (hObject=0x23c) returned 1 [0147.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx", lpFilePart=0x0) returned 0x41 [0147.176] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\5AAs3v4MTKmTk4CZQFXd.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\5aas3v4mtkmtk4czqfxd.pptx")) returned 1 [0147.178] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", lpFilePart=0x0) returned 0x40 [0147.178] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", dwFileAttributes=0x80) returned 1 [0147.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx.Horsuke", lpFilePart=0x0) returned 0x48 [0147.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0147.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6awlug8wsxnv-ihivhq.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0147.179] GetFileType (hFile=0x15c) returned 0x1 [0147.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0147.180] GetFileType (hFile=0x15c) returned 0x1 [0147.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", lpFilePart=0x0) returned 0x40 [0147.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0147.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6awlug8wsxnv-ihivhq.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0147.645] GetFileType (hFile=0x23c) returned 0x1 [0147.645] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0147.645] GetFileType (hFile=0x23c) returned 0x1 [0147.645] ReadFile (in: hFile=0x23c, lpBuffer=0x23faf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23faf38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.647] ReadFile (in: hFile=0x23c, lpBuffer=0x23faf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23faf38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.650] ReadFile (in: hFile=0x23c, lpBuffer=0x23faf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23faf38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.651] ReadFile (in: hFile=0x23c, lpBuffer=0x23faf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23faf38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0147.651] ReadFile (in: hFile=0x23c, lpBuffer=0x23faf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23faf38*, lpNumberOfBytesRead=0x2edf68*=0x252, lpOverlapped=0x0) returned 1 [0147.651] ReadFile (in: hFile=0x23c, lpBuffer=0x23faf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23faf38*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0147.651] CloseHandle (hObject=0x23c) returned 1 [0147.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx", lpFilePart=0x0) returned 0x40 [0147.651] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\6AwLug8WSXnv-IHIVhQ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\6awlug8wsxnv-ihivhq.xlsx")) returned 1 [0147.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", lpFilePart=0x0) returned 0x31 [0147.653] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", dwFileAttributes=0x80) returned 1 [0147.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls.Horsuke", lpFilePart=0x0) returned 0x39 [0147.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0147.654] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\938yk.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0147.654] GetFileType (hFile=0x15c) returned 0x1 [0147.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0147.654] GetFileType (hFile=0x15c) returned 0x1 [0148.145] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", lpFilePart=0x0) returned 0x31 [0148.146] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0148.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\938yk.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0148.146] GetFileType (hFile=0x23c) returned 0x1 [0148.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0148.146] GetFileType (hFile=0x23c) returned 0x1 [0148.146] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.151] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.152] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.152] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.152] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.152] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.153] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0xbce, lpOverlapped=0x0) returned 1 [0148.153] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b4e, nNumberOfBytesToRead=0x32, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b4e*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0148.153] ReadFile (in: hFile=0x23c, lpBuffer=0x22e7b98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e7b98*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0148.153] CloseHandle (hObject=0x23c) returned 1 [0148.153] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls", lpFilePart=0x0) returned 0x31 [0148.153] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\938YK.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\938yk.xls")) returned 1 [0148.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", lpFilePart=0x0) returned 0x3d [0148.154] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", dwFileAttributes=0x80) returned 1 [0148.155] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx.Horsuke", lpFilePart=0x0) returned 0x45 [0148.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0148.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9glrvarupn_pu-eb.docx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0148.156] GetFileType (hFile=0x15c) returned 0x1 [0148.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0148.156] GetFileType (hFile=0x15c) returned 0x1 [0148.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", lpFilePart=0x0) returned 0x3d [0148.632] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0148.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9glrvarupn_pu-eb.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0148.632] GetFileType (hFile=0x23c) returned 0x1 [0148.632] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0148.632] GetFileType (hFile=0x23c) returned 0x1 [0148.632] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.637] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.637] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.638] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.638] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.638] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.638] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.639] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.639] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.639] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.639] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.639] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.640] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.640] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.640] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.640] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.640] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0148.641] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x8d2, lpOverlapped=0x0) returned 1 [0148.641] ReadFile (in: hFile=0x23c, lpBuffer=0x23d6ec2, nNumberOfBytesToRead=0x32e, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d6ec2*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0148.641] ReadFile (in: hFile=0x23c, lpBuffer=0x23d7208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d7208*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0148.641] CloseHandle (hObject=0x23c) returned 1 [0148.641] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx", lpFilePart=0x0) returned 0x3d [0148.641] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9glRvArUpN_pu-Eb.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9glrvarupn_pu-eb.docx")) returned 1 [0148.643] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", lpFilePart=0x0) returned 0x31 [0148.643] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", dwFileAttributes=0x80) returned 1 [0148.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx.Horsuke", lpFilePart=0x0) returned 0x39 [0148.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0148.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9lkf.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0148.644] GetFileType (hFile=0x15c) returned 0x1 [0148.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0148.644] GetFileType (hFile=0x15c) returned 0x1 [0149.110] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", lpFilePart=0x0) returned 0x31 [0149.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0149.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9lkf.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0149.111] GetFileType (hFile=0x23c) returned 0x1 [0149.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0149.111] GetFileType (hFile=0x23c) returned 0x1 [0149.111] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.116] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.117] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.117] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.117] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.117] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.117] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.118] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.118] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.118] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.118] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.119] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.119] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0xa20, lpOverlapped=0x0) returned 1 [0149.119] ReadFile (in: hFile=0x23c, lpBuffer=0x22d1800, nNumberOfBytesToRead=0x1e0, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d1800*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0149.119] ReadFile (in: hFile=0x23c, lpBuffer=0x22d19f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22d19f8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0149.119] CloseHandle (hObject=0x23c) returned 1 [0149.119] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx", lpFilePart=0x0) returned 0x31 [0149.120] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9lKf.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9lkf.xlsx")) returned 1 [0149.121] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", lpFilePart=0x0) returned 0x38 [0149.121] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", dwFileAttributes=0x80) returned 1 [0149.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls.Horsuke", lpFilePart=0x0) returned 0x40 [0149.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0149.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9okqxwdooo26.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0149.123] GetFileType (hFile=0x15c) returned 0x1 [0149.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0149.123] GetFileType (hFile=0x15c) returned 0x1 [0149.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", lpFilePart=0x0) returned 0x38 [0149.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0149.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9okqxwdooo26.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0149.659] GetFileType (hFile=0x23c) returned 0x1 [0149.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0149.659] GetFileType (hFile=0x23c) returned 0x1 [0149.659] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.664] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.664] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.664] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.664] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.664] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.665] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.665] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.665] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.665] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.666] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.666] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.666] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.666] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.666] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.667] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.667] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.667] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.667] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0149.667] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x76d, lpOverlapped=0x0) returned 1 [0149.667] ReadFile (in: hFile=0x23c, lpBuffer=0x23c7005, nNumberOfBytesToRead=0x93, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c7005*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0149.668] ReadFile (in: hFile=0x23c, lpBuffer=0x23c70b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c70b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0149.668] CloseHandle (hObject=0x23c) returned 1 [0149.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls", lpFilePart=0x0) returned 0x38 [0149.668] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\9OkQxWDoOo26.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\9okqxwdooo26.xls")) returned 1 [0149.669] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", lpFilePart=0x0) returned 0x32 [0149.669] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", dwFileAttributes=0x80) returned 1 [0149.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx.Horsuke", lpFilePart=0x0) returned 0x3a [0149.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0149.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aj1gd.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0149.671] GetFileType (hFile=0x15c) returned 0x1 [0149.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0149.671] GetFileType (hFile=0x15c) returned 0x1 [0150.257] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", lpFilePart=0x0) returned 0x32 [0150.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0150.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aj1gd.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0150.259] GetFileType (hFile=0x23c) returned 0x1 [0150.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0150.259] GetFileType (hFile=0x23c) returned 0x1 [0150.259] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0xe77, lpOverlapped=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22c362f, nNumberOfBytesToRead=0x189, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c362f*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0150.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22c37d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c37d0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0150.265] CloseHandle (hObject=0x23c) returned 1 [0150.266] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx", lpFilePart=0x0) returned 0x32 [0150.266] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\aj1gD.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\aj1gd.xlsx")) returned 1 [0150.267] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", lpFilePart=0x0) returned 0x37 [0150.267] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", dwFileAttributes=0x80) returned 1 [0150.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx.Horsuke", lpFilePart=0x0) returned 0x3f [0150.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0150.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ayfgntlh1-.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0150.269] GetFileType (hFile=0x15c) returned 0x1 [0150.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0150.269] GetFileType (hFile=0x15c) returned 0x1 [0150.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", lpFilePart=0x0) returned 0x37 [0150.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0150.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ayfgntlh1-.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0150.748] GetFileType (hFile=0x23c) returned 0x1 [0150.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0150.749] GetFileType (hFile=0x23c) returned 0x1 [0150.749] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.754] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.755] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.755] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.755] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.756] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.756] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.756] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.757] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.757] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0150.757] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x1d4, lpOverlapped=0x0) returned 1 [0150.758] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4a70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4a70*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0150.758] CloseHandle (hObject=0x23c) returned 1 [0150.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx", lpFilePart=0x0) returned 0x37 [0150.758] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\AYFgNtlh1-.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ayfgntlh1-.pptx")) returned 1 [0150.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", lpFilePart=0x0) returned 0x33 [0150.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", dwFileAttributes=0x80) returned 1 [0150.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx.Horsuke", lpFilePart=0x0) returned 0x3b [0150.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0150.761] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\blxvom.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0150.762] GetFileType (hFile=0x15c) returned 0x1 [0150.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0150.763] GetFileType (hFile=0x15c) returned 0x1 [0151.253] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", lpFilePart=0x0) returned 0x33 [0151.253] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0151.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\blxvom.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0151.254] GetFileType (hFile=0x23c) returned 0x1 [0151.254] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0151.254] GetFileType (hFile=0x23c) returned 0x1 [0151.254] ReadFile (in: hFile=0x23c, lpBuffer=0x22a6ef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a6ef0*, lpNumberOfBytesRead=0x2edf68*=0x871, lpOverlapped=0x0) returned 1 [0151.256] ReadFile (in: hFile=0x23c, lpBuffer=0x22a6b49, nNumberOfBytesToRead=0x38f, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a6b49*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0151.257] ReadFile (in: hFile=0x23c, lpBuffer=0x22a6ef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a6ef0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0151.257] CloseHandle (hObject=0x23c) returned 1 [0151.257] WriteFile (in: hFile=0x15c, lpBuffer=0x22a5420*, nNumberOfBytesToWrite=0x8a0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22a5420*, lpNumberOfBytesWritten=0x2ede38*=0x8a0, lpOverlapped=0x0) returned 1 [0151.258] CloseHandle (hObject=0x15c) returned 1 [0151.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx", lpFilePart=0x0) returned 0x33 [0151.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\blXVOM.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\blxvom.pptx")) returned 1 [0151.259] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", lpFilePart=0x0) returned 0x3d [0151.259] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", dwFileAttributes=0x80) returned 1 [0151.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv.Horsuke", lpFilePart=0x0) returned 0x45 [0151.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0151.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dg-tn_jetojs_k z5.csv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0151.261] GetFileType (hFile=0x15c) returned 0x1 [0151.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0151.261] GetFileType (hFile=0x15c) returned 0x1 [0151.749] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", lpFilePart=0x0) returned 0x3d [0151.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0151.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dg-tn_jetojs_k z5.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0151.750] GetFileType (hFile=0x23c) returned 0x1 [0151.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0151.750] GetFileType (hFile=0x23c) returned 0x1 [0151.750] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.755] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.756] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.756] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.756] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.757] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.757] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.757] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.757] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.758] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.758] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.758] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0xbd8, lpOverlapped=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x23c, lpBuffer=0x238e148, nNumberOfBytesToRead=0x28, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e148*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0151.759] ReadFile (in: hFile=0x23c, lpBuffer=0x238e188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x238e188*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0151.759] CloseHandle (hObject=0x23c) returned 1 [0151.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv", lpFilePart=0x0) returned 0x3d [0151.760] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Dg-tn_jEtOJs_K z5.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dg-tn_jetojs_k z5.csv")) returned 1 [0151.761] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", lpFilePart=0x0) returned 0x3c [0151.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", dwFileAttributes=0x80) returned 1 [0151.763] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx.Horsuke", lpFilePart=0x0) returned 0x44 [0151.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0151.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dtazwlwayxhomjj.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0151.764] GetFileType (hFile=0x15c) returned 0x1 [0151.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0151.764] GetFileType (hFile=0x15c) returned 0x1 [0152.248] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", lpFilePart=0x0) returned 0x3c [0152.249] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0152.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dtazwlwayxhomjj.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0152.249] GetFileType (hFile=0x23c) returned 0x1 [0152.249] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0152.249] GetFileType (hFile=0x23c) returned 0x1 [0152.249] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.254] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.255] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.255] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.255] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.255] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.256] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.256] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.256] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.256] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.256] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.257] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.257] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x9ce, lpOverlapped=0x0) returned 1 [0152.257] ReadFile (in: hFile=0x23c, lpBuffer=0x228298e, nNumberOfBytesToRead=0x232, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228298e*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0152.257] ReadFile (in: hFile=0x23c, lpBuffer=0x2282bd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2282bd8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0152.257] CloseHandle (hObject=0x23c) returned 1 [0152.258] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx", lpFilePart=0x0) returned 0x3c [0152.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\dtAZwLwayxhomjJ.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\dtazwlwayxhomjj.xlsx")) returned 1 [0152.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", lpFilePart=0x0) returned 0x34 [0152.260] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", dwFileAttributes=0x80) returned 1 [0152.261] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx.Horsuke", lpFilePart=0x0) returned 0x3c [0152.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0152.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ebwclin.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0152.262] GetFileType (hFile=0x15c) returned 0x1 [0152.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0152.262] GetFileType (hFile=0x15c) returned 0x1 [0152.740] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", lpFilePart=0x0) returned 0x34 [0152.740] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0152.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ebwclin.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0152.741] GetFileType (hFile=0x23c) returned 0x1 [0152.741] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0152.741] GetFileType (hFile=0x23c) returned 0x1 [0152.741] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.746] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.746] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.746] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.747] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.747] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.747] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.747] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0152.747] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x9e1, lpOverlapped=0x0) returned 1 [0152.748] ReadFile (in: hFile=0x23c, lpBuffer=0x2376141, nNumberOfBytesToRead=0x21f, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376141*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0152.748] ReadFile (in: hFile=0x23c, lpBuffer=0x2376378, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2376378*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0152.748] CloseHandle (hObject=0x23c) returned 1 [0152.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx", lpFilePart=0x0) returned 0x34 [0152.748] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eBWCliN.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ebwclin.pptx")) returned 1 [0152.750] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", lpFilePart=0x0) returned 0x34 [0152.750] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", dwFileAttributes=0x80) returned 1 [0152.751] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt.Horsuke", lpFilePart=0x0) returned 0x3c [0152.751] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0152.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\enn9r774.ppt.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0152.751] GetFileType (hFile=0x15c) returned 0x1 [0152.751] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0152.751] GetFileType (hFile=0x15c) returned 0x1 [0153.268] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", lpFilePart=0x0) returned 0x34 [0153.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0153.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\enn9r774.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0153.268] GetFileType (hFile=0x23c) returned 0x1 [0153.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0153.268] GetFileType (hFile=0x23c) returned 0x1 [0153.269] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.273] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.274] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.274] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.274] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.274] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.275] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x1de, lpOverlapped=0x0) returned 1 [0153.275] ReadFile (in: hFile=0x23c, lpBuffer=0x22481e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22481e0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0153.275] CloseHandle (hObject=0x23c) returned 1 [0153.275] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt", lpFilePart=0x0) returned 0x34 [0153.275] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\eNN9R774.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\enn9r774.ppt")) returned 1 [0153.276] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", lpFilePart=0x0) returned 0x3a [0153.277] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", dwFileAttributes=0x80) returned 1 [0153.278] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx.Horsuke", lpFilePart=0x0) returned 0x42 [0153.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0153.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eubce cltmnyw.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0153.279] GetFileType (hFile=0x15c) returned 0x1 [0153.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0153.279] GetFileType (hFile=0x15c) returned 0x1 [0153.747] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", lpFilePart=0x0) returned 0x3a [0153.747] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0153.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eubce cltmnyw.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0153.748] GetFileType (hFile=0x23c) returned 0x1 [0153.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0153.748] GetFileType (hFile=0x23c) returned 0x1 [0153.748] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.753] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.753] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.754] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.754] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.754] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.754] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.755] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.755] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.755] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.755] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.755] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.756] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.756] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.756] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.756] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.756] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x7a2, lpOverlapped=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x23c, lpBuffer=0x2336d82, nNumberOfBytesToRead=0x5e, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336d82*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0153.757] ReadFile (in: hFile=0x23c, lpBuffer=0x2336df8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2336df8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0153.757] CloseHandle (hObject=0x23c) returned 1 [0153.758] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx", lpFilePart=0x0) returned 0x3a [0153.758] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\EuBCe CltmnyW.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\eubce cltmnyw.pptx")) returned 1 [0153.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", lpFilePart=0x0) returned 0x3e [0153.760] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", dwFileAttributes=0x80) returned 1 [0153.760] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx.Horsuke", lpFilePart=0x0) returned 0x46 [0153.760] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0153.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hayrhqwzbkrxfxbfp.xlsx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0153.761] GetFileType (hFile=0x15c) returned 0x1 [0153.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0153.761] GetFileType (hFile=0x15c) returned 0x1 [0154.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", lpFilePart=0x0) returned 0x3e [0154.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0154.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hayrhqwzbkrxfxbfp.xlsx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0154.253] GetFileType (hFile=0x23c) returned 0x1 [0154.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0154.253] GetFileType (hFile=0x23c) returned 0x1 [0154.253] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.258] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.258] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.258] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.259] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.259] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.259] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.259] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.260] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.260] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.260] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0xfd5, lpOverlapped=0x0) returned 1 [0154.260] ReadFile (in: hFile=0x23c, lpBuffer=0x223356d, nNumberOfBytesToRead=0x2b, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x223356d*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0154.260] ReadFile (in: hFile=0x23c, lpBuffer=0x22335b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22335b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0154.260] CloseHandle (hObject=0x23c) returned 1 [0154.260] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx", lpFilePart=0x0) returned 0x3e [0154.261] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HAYrHQwzBkRxFxbfp.xlsx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hayrhqwzbkrxfxbfp.xlsx")) returned 1 [0154.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", lpFilePart=0x0) returned 0x3e [0154.262] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", dwFileAttributes=0x80) returned 1 [0154.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls.Horsuke", lpFilePart=0x0) returned 0x46 [0154.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0154.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hh8jlllrcjm12fl-46.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0154.263] GetFileType (hFile=0x15c) returned 0x1 [0154.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0154.264] GetFileType (hFile=0x15c) returned 0x1 [0154.787] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", lpFilePart=0x0) returned 0x3e [0154.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0154.787] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hh8jlllrcjm12fl-46.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0154.788] GetFileType (hFile=0x23c) returned 0x1 [0154.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0154.788] GetFileType (hFile=0x23c) returned 0x1 [0154.788] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.792] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.794] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.794] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.794] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.795] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.795] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0154.795] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x9da, lpOverlapped=0x0) returned 1 [0154.795] ReadFile (in: hFile=0x23c, lpBuffer=0x2326f82, nNumberOfBytesToRead=0x226, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2326f82*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0154.796] ReadFile (in: hFile=0x23c, lpBuffer=0x23271c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23271c0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0154.796] CloseHandle (hObject=0x23c) returned 1 [0154.796] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls", lpFilePart=0x0) returned 0x3e [0154.796] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\HH8JllLRcjM12fL-46.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hh8jlllrcjm12fl-46.xls")) returned 1 [0154.798] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", lpFilePart=0x0) returned 0x3d [0154.798] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", dwFileAttributes=0x80) returned 1 [0154.799] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods.Horsuke", lpFilePart=0x0) returned 0x45 [0154.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0154.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hhth9wx_l3wvvican.ods.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0154.800] GetFileType (hFile=0x15c) returned 0x1 [0154.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0154.800] GetFileType (hFile=0x15c) returned 0x1 [0155.288] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", lpFilePart=0x0) returned 0x3d [0155.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0155.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hhth9wx_l3wvvican.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0155.289] GetFileType (hFile=0x23c) returned 0x1 [0155.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0155.289] GetFileType (hFile=0x23c) returned 0x1 [0155.289] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.294] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.295] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.295] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.295] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.295] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x689, lpOverlapped=0x0) returned 1 [0155.295] ReadFile (in: hFile=0x23c, lpBuffer=0x2417541, nNumberOfBytesToRead=0x177, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2417541*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0155.296] ReadFile (in: hFile=0x23c, lpBuffer=0x24176d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x24176d0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0155.296] CloseHandle (hObject=0x23c) returned 1 [0155.296] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods", lpFilePart=0x0) returned 0x3d [0155.296] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\hHTh9WX_l3wVVICAn.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hhth9wx_l3wvvican.ods")) returned 1 [0155.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", lpFilePart=0x0) returned 0x3f [0155.297] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", dwFileAttributes=0x80) returned 1 [0155.298] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls.Horsuke", lpFilePart=0x0) returned 0x47 [0155.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0155.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ihyq-oh5sqc5qm31yrb.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0155.299] GetFileType (hFile=0x15c) returned 0x1 [0155.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0155.299] GetFileType (hFile=0x15c) returned 0x1 [0155.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", lpFilePart=0x0) returned 0x3f [0155.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0155.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ihyq-oh5sqc5qm31yrb.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0155.891] GetFileType (hFile=0x23c) returned 0x1 [0155.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0155.891] GetFileType (hFile=0x23c) returned 0x1 [0155.891] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.894] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.897] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.897] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.897] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.897] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0155.898] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x734, lpOverlapped=0x0) returned 1 [0155.898] ReadFile (in: hFile=0x23c, lpBuffer=0x2305764, nNumberOfBytesToRead=0xcc, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305764*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0155.898] ReadFile (in: hFile=0x23c, lpBuffer=0x2305848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2305848*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0155.898] CloseHandle (hObject=0x23c) returned 1 [0155.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls", lpFilePart=0x0) returned 0x3f [0155.898] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\IHYq-OH5sQc5qM31YRB.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\ihyq-oh5sqc5qm31yrb.xls")) returned 1 [0155.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", lpFilePart=0x0) returned 0x3e [0155.900] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", dwFileAttributes=0x80) returned 1 [0155.900] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt.Horsuke", lpFilePart=0x0) returned 0x46 [0155.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0155.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\irgpobsyokaow5v-9v.ppt.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0155.901] GetFileType (hFile=0x15c) returned 0x1 [0155.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0155.902] GetFileType (hFile=0x15c) returned 0x1 [0156.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", lpFilePart=0x0) returned 0x3e [0156.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0156.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\irgpobsyokaow5v-9v.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0156.450] GetFileType (hFile=0x23c) returned 0x1 [0156.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0156.450] GetFileType (hFile=0x23c) returned 0x1 [0156.450] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.455] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.455] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.456] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.456] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.456] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.456] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0xe70, lpOverlapped=0x0) returned 1 [0156.457] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4880, nNumberOfBytesToRead=0x190, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4880*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0156.457] ReadFile (in: hFile=0x23c, lpBuffer=0x23f4a28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23f4a28*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0156.457] CloseHandle (hObject=0x23c) returned 1 [0156.457] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt", lpFilePart=0x0) returned 0x3e [0156.457] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\iRgPoBSyOkaOW5V-9V.ppt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\irgpobsyokaow5v-9v.ppt")) returned 1 [0156.458] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", lpFilePart=0x0) returned 0x3c [0156.458] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", dwFileAttributes=0x80) returned 1 [0156.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc.Horsuke", lpFilePart=0x0) returned 0x44 [0156.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0156.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jytidkaukxk0tzvl.doc.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0156.460] GetFileType (hFile=0x15c) returned 0x1 [0156.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0156.460] GetFileType (hFile=0x15c) returned 0x1 [0156.985] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", lpFilePart=0x0) returned 0x3c [0156.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0156.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jytidkaukxk0tzvl.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0156.986] GetFileType (hFile=0x23c) returned 0x1 [0156.986] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0156.986] GetFileType (hFile=0x23c) returned 0x1 [0156.986] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e4400*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.991] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e4400*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.992] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e4400*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0156.992] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e4400*, lpNumberOfBytesRead=0x2edf68*=0x8ab, lpOverlapped=0x0) returned 1 [0156.992] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4093, nNumberOfBytesToRead=0x355, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e4093*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0156.992] ReadFile (in: hFile=0x23c, lpBuffer=0x22e4400, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22e4400*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0156.992] CloseHandle (hObject=0x23c) returned 1 [0156.992] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc", lpFilePart=0x0) returned 0x3c [0156.992] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\jYtiDKAuKXK0Tzvl.doc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\jytidkaukxk0tzvl.doc")) returned 1 [0156.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", lpFilePart=0x0) returned 0x3a [0156.994] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", dwFileAttributes=0x80) returned 1 [0156.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf.Horsuke", lpFilePart=0x0) returned 0x42 [0156.995] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0156.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kh1kwpqmywfclw.rtf.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0156.995] GetFileType (hFile=0x15c) returned 0x1 [0156.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0156.996] GetFileType (hFile=0x15c) returned 0x1 [0157.477] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", lpFilePart=0x0) returned 0x3a [0157.477] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0157.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kh1kwpqmywfclw.rtf"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0157.477] GetFileType (hFile=0x23c) returned 0x1 [0157.477] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0157.478] GetFileType (hFile=0x23c) returned 0x1 [0157.478] ReadFile (in: hFile=0x23c, lpBuffer=0x23d0648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d0648*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0157.483] ReadFile (in: hFile=0x23c, lpBuffer=0x23d0648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d0648*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0157.483] ReadFile (in: hFile=0x23c, lpBuffer=0x23d0648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d0648*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0157.483] ReadFile (in: hFile=0x23c, lpBuffer=0x23d0648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d0648*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0157.483] ReadFile (in: hFile=0x23c, lpBuffer=0x23d0648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d0648*, lpNumberOfBytesRead=0x2edf68*=0x28, lpOverlapped=0x0) returned 1 [0157.483] ReadFile (in: hFile=0x23c, lpBuffer=0x23d0648, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23d0648*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0157.484] CloseHandle (hObject=0x23c) returned 1 [0157.484] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf", lpFilePart=0x0) returned 0x3a [0157.484] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\KH1KwpQMywFCLW.rtf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\kh1kwpqmywfclw.rtf")) returned 1 [0157.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", lpFilePart=0x0) returned 0x32 [0157.485] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", dwFileAttributes=0x80) returned 1 [0157.486] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls.Horsuke", lpFilePart=0x0) returned 0x3a [0157.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0157.486] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n2ydti.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0157.555] GetFileType (hFile=0x15c) returned 0x1 [0157.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0157.555] GetFileType (hFile=0x15c) returned 0x1 [0158.020] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", lpFilePart=0x0) returned 0x32 [0158.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0158.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n2ydti.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0158.021] GetFileType (hFile=0x23c) returned 0x1 [0158.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0158.021] GetFileType (hFile=0x23c) returned 0x1 [0158.021] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.024] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.026] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.026] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.027] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.027] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.028] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.028] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.028] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.028] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x832, lpOverlapped=0x0) returned 1 [0158.028] ReadFile (in: hFile=0x23c, lpBuffer=0x22bcc82, nNumberOfBytesToRead=0x3ce, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bcc82*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0158.029] ReadFile (in: hFile=0x23c, lpBuffer=0x22bd068, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22bd068*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0158.029] CloseHandle (hObject=0x23c) returned 1 [0158.029] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls", lpFilePart=0x0) returned 0x32 [0158.029] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\n2Ydti.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\n2ydti.xls")) returned 1 [0158.030] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", lpFilePart=0x0) returned 0x31 [0158.030] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", dwFileAttributes=0x80) returned 1 [0158.031] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx.Horsuke", lpFilePart=0x0) returned 0x39 [0158.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0158.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p6iq.docx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0158.032] GetFileType (hFile=0x15c) returned 0x1 [0158.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0158.032] GetFileType (hFile=0x15c) returned 0x1 [0158.531] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", lpFilePart=0x0) returned 0x31 [0158.531] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0158.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p6iq.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0158.532] GetFileType (hFile=0x23c) returned 0x1 [0158.532] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0158.532] GetFileType (hFile=0x23c) returned 0x1 [0158.532] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.537] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.537] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.537] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.538] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.539] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.539] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.539] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.539] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.539] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.540] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.540] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.540] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.540] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0158.540] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0xbec, lpOverlapped=0x0) returned 1 [0158.541] ReadFile (in: hFile=0x23c, lpBuffer=0x23af384, nNumberOfBytesToRead=0x14, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af384*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0158.541] ReadFile (in: hFile=0x23c, lpBuffer=0x23af3b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23af3b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0158.541] CloseHandle (hObject=0x23c) returned 1 [0158.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx", lpFilePart=0x0) returned 0x31 [0158.541] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\p6iq.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p6iq.docx")) returned 1 [0158.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", lpFilePart=0x0) returned 0x3b [0158.543] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", dwFileAttributes=0x80) returned 1 [0158.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls.Horsuke", lpFilePart=0x0) returned 0x43 [0158.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0158.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p72cqwppj6k -tr.xls.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0158.544] GetFileType (hFile=0x15c) returned 0x1 [0158.544] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0158.544] GetFileType (hFile=0x15c) returned 0x1 [0159.099] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", lpFilePart=0x0) returned 0x3b [0159.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0159.099] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p72cqwppj6k -tr.xls"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0159.100] GetFileType (hFile=0x23c) returned 0x1 [0159.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0159.100] GetFileType (hFile=0x23c) returned 0x1 [0159.100] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.107] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.107] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.108] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.108] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.108] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.109] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.109] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.109] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.109] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.110] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.110] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.110] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.111] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.111] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.111] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x80e, lpOverlapped=0x0) returned 1 [0159.111] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9af6, nNumberOfBytesToRead=0x3f2, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9af6*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0159.112] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9f00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22a9f00*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0159.112] CloseHandle (hObject=0x23c) returned 1 [0159.112] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls", lpFilePart=0x0) returned 0x3b [0159.112] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\P72CqWpPJ6K -TR.xls" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\p72cqwppj6k -tr.xls")) returned 1 [0159.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", lpFilePart=0x0) returned 0x34 [0159.114] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", dwFileAttributes=0x80) returned 1 [0159.114] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods.Horsuke", lpFilePart=0x0) returned 0x3c [0159.115] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0159.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qpodvv1h.ods.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0159.116] GetFileType (hFile=0x15c) returned 0x1 [0159.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0159.116] GetFileType (hFile=0x15c) returned 0x1 [0159.595] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", lpFilePart=0x0) returned 0x34 [0159.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0159.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qpodvv1h.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0159.596] GetFileType (hFile=0x23c) returned 0x1 [0159.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0159.596] GetFileType (hFile=0x23c) returned 0x1 [0159.596] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.601] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.608] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.608] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.608] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.608] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.609] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0159.609] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0xa78, lpOverlapped=0x0) returned 1 [0159.609] ReadFile (in: hFile=0x23c, lpBuffer=0x23a2340, nNumberOfBytesToRead=0x188, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a2340*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0159.609] ReadFile (in: hFile=0x23c, lpBuffer=0x23a24e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a24e0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0159.609] CloseHandle (hObject=0x23c) returned 1 [0159.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods", lpFilePart=0x0) returned 0x34 [0159.610] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\qPOdVv1H.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\qpodvv1h.ods")) returned 1 [0159.611] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", lpFilePart=0x0) returned 0x3e [0159.611] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", dwFileAttributes=0x80) returned 1 [0159.612] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx.Horsuke", lpFilePart=0x0) returned 0x46 [0159.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0159.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtlsaqkcbuvewrg_f.docx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0159.612] GetFileType (hFile=0x15c) returned 0x1 [0159.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0159.612] GetFileType (hFile=0x15c) returned 0x1 [0160.087] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", lpFilePart=0x0) returned 0x3e [0160.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0160.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtlsaqkcbuvewrg_f.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0160.088] GetFileType (hFile=0x23c) returned 0x1 [0160.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0160.088] GetFileType (hFile=0x23c) returned 0x1 [0160.088] ReadFile (in: hFile=0x23c, lpBuffer=0x2292b58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2292b58*, lpNumberOfBytesRead=0x2edf68*=0x9de, lpOverlapped=0x0) returned 1 [0160.090] ReadFile (in: hFile=0x23c, lpBuffer=0x229291e, nNumberOfBytesToRead=0x222, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x229291e*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0160.090] ReadFile (in: hFile=0x23c, lpBuffer=0x2292b58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2292b58*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0160.090] CloseHandle (hObject=0x23c) returned 1 [0160.091] WriteFile (in: hFile=0x15c, lpBuffer=0x2291058*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2291058*, lpNumberOfBytesWritten=0x2ede38*=0xa00, lpOverlapped=0x0) returned 1 [0160.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx", lpFilePart=0x0) returned 0x3e [0160.092] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RtlSaQkcBuvEwRG_F.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rtlsaqkcbuvewrg_f.docx")) returned 1 [0160.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", lpFilePart=0x0) returned 0x35 [0160.093] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", dwFileAttributes=0x80) returned 1 [0160.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx.Horsuke", lpFilePart=0x0) returned 0x3d [0160.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0160.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rw8wgtbl.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0160.094] GetFileType (hFile=0x15c) returned 0x1 [0160.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0160.094] GetFileType (hFile=0x15c) returned 0x1 [0160.565] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", lpFilePart=0x0) returned 0x35 [0160.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0160.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rw8wgtbl.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0160.566] GetFileType (hFile=0x23c) returned 0x1 [0160.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0160.566] GetFileType (hFile=0x23c) returned 0x1 [0160.566] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0160.571] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0160.572] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0160.572] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0160.572] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0160.572] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x287, lpOverlapped=0x0) returned 1 [0160.572] ReadFile (in: hFile=0x23c, lpBuffer=0x237bd38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x237bd38*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0160.572] CloseHandle (hObject=0x23c) returned 1 [0160.573] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx", lpFilePart=0x0) returned 0x35 [0160.573] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\RW8wGtBL.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\rw8wgtbl.pptx")) returned 1 [0160.574] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", lpFilePart=0x0) returned 0x39 [0160.574] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", dwFileAttributes=0x80) returned 1 [0160.575] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods.Horsuke", lpFilePart=0x0) returned 0x41 [0160.575] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0160.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tmtcu co3cmty.ods.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0160.576] GetFileType (hFile=0x15c) returned 0x1 [0160.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0160.576] GetFileType (hFile=0x15c) returned 0x1 [0161.047] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", lpFilePart=0x0) returned 0x39 [0161.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0161.047] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tmtcu co3cmty.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0161.048] GetFileType (hFile=0x23c) returned 0x1 [0161.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0161.048] GetFileType (hFile=0x23c) returned 0x1 [0161.048] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.053] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.053] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.053] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.054] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.055] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.055] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.055] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.055] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.055] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.056] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.056] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.056] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x4a9, lpOverlapped=0x0) returned 1 [0161.056] ReadFile (in: hFile=0x23c, lpBuffer=0x2269719, nNumberOfBytesToRead=0x357, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269719*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0161.056] ReadFile (in: hFile=0x23c, lpBuffer=0x2269a88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2269a88*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0161.056] CloseHandle (hObject=0x23c) returned 1 [0161.057] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods", lpFilePart=0x0) returned 0x39 [0161.057] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\TMtCu Co3cMTY.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\tmtcu co3cmty.ods")) returned 1 [0161.058] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", lpFilePart=0x0) returned 0x37 [0161.058] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", dwFileAttributes=0x80) returned 1 [0161.059] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx.Horsuke", lpFilePart=0x0) returned 0x3f [0161.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0161.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\trm-kzdklp.docx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0161.060] GetFileType (hFile=0x15c) returned 0x1 [0161.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0161.060] GetFileType (hFile=0x15c) returned 0x1 [0161.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", lpFilePart=0x0) returned 0x37 [0161.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0161.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\trm-kzdklp.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0161.535] GetFileType (hFile=0x23c) returned 0x1 [0161.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0161.535] GetFileType (hFile=0x23c) returned 0x1 [0161.535] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.540] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.541] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.541] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.541] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.541] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.542] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.542] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.542] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.542] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0161.542] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x829, lpOverlapped=0x0) returned 1 [0161.543] ReadFile (in: hFile=0x23c, lpBuffer=0x2362969, nNumberOfBytesToRead=0x3d7, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362969*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0161.543] ReadFile (in: hFile=0x23c, lpBuffer=0x2362d58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2362d58*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0161.543] CloseHandle (hObject=0x23c) returned 1 [0161.543] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx", lpFilePart=0x0) returned 0x37 [0161.543] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\trM-KZDklP.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\trm-kzdklp.docx")) returned 1 [0161.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", lpFilePart=0x0) returned 0x38 [0161.544] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", dwFileAttributes=0x80) returned 1 [0161.545] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx.Horsuke", lpFilePart=0x0) returned 0x40 [0161.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0161.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vludvrszoky.pptx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0161.546] GetFileType (hFile=0x15c) returned 0x1 [0161.546] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0161.546] GetFileType (hFile=0x15c) returned 0x1 [0162.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", lpFilePart=0x0) returned 0x38 [0162.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0162.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vludvrszoky.pptx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0162.009] GetFileType (hFile=0x23c) returned 0x1 [0162.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0162.009] GetFileType (hFile=0x23c) returned 0x1 [0162.009] ReadFile (in: hFile=0x23c, lpBuffer=0x2255ab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2255ab0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.013] ReadFile (in: hFile=0x23c, lpBuffer=0x2255ab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2255ab0*, lpNumberOfBytesRead=0x2edf68*=0xf10, lpOverlapped=0x0) returned 1 [0162.014] ReadFile (in: hFile=0x23c, lpBuffer=0x22559a8, nNumberOfBytesToRead=0xf0, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22559a8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0162.014] ReadFile (in: hFile=0x23c, lpBuffer=0x2255ab0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2255ab0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0162.014] CloseHandle (hObject=0x23c) returned 1 [0162.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx", lpFilePart=0x0) returned 0x38 [0162.014] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\VlUDvRSZoKy.pptx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\vludvrszoky.pptx")) returned 1 [0162.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", lpFilePart=0x0) returned 0x3d [0162.016] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", dwFileAttributes=0x80) returned 1 [0162.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods.Horsuke", lpFilePart=0x0) returned 0x45 [0162.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0162.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xyt_fs7zmk5eybzsv.ods.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0162.017] GetFileType (hFile=0x15c) returned 0x1 [0162.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0162.017] GetFileType (hFile=0x15c) returned 0x1 [0162.593] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", lpFilePart=0x0) returned 0x3d [0162.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0162.593] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xyt_fs7zmk5eybzsv.ods"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0162.594] GetFileType (hFile=0x23c) returned 0x1 [0162.594] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0162.594] GetFileType (hFile=0x23c) returned 0x1 [0162.594] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.600] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.600] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.600] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.601] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.601] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.601] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.601] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.602] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.602] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.602] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.602] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.602] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.603] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.603] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.603] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.603] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.604] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0162.604] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x20a, lpOverlapped=0x0) returned 1 [0162.604] ReadFile (in: hFile=0x23c, lpBuffer=0x233fa08, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x233fa08*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0162.604] CloseHandle (hObject=0x23c) returned 1 [0162.604] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods", lpFilePart=0x0) returned 0x3d [0162.604] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\xyt_fs7ZmK5eYbzSv.ods" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\xyt_fs7zmk5eybzsv.ods")) returned 1 [0162.606] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", lpFilePart=0x0) returned 0x3b [0162.606] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", dwFileAttributes=0x80) returned 1 [0162.607] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx.Horsuke", lpFilePart=0x0) returned 0x43 [0162.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0162.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zc3bmxj8ob4okd.docx.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0162.608] GetFileType (hFile=0x15c) returned 0x1 [0162.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0162.608] GetFileType (hFile=0x15c) returned 0x1 [0163.078] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", lpFilePart=0x0) returned 0x3b [0163.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0163.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zc3bmxj8ob4okd.docx"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0163.078] GetFileType (hFile=0x23c) returned 0x1 [0163.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0163.078] GetFileType (hFile=0x23c) returned 0x1 [0163.078] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.083] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2416e80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2416e80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.088] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.089] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.089] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.089] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.089] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.090] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.090] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.090] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.090] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x45b, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x23c, lpBuffer=0x2224813, nNumberOfBytesToRead=0x3a5, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224813*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0163.091] ReadFile (in: hFile=0x23c, lpBuffer=0x2224bd0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2224bd0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0163.091] CloseHandle (hObject=0x23c) returned 1 [0163.092] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx", lpFilePart=0x0) returned 0x3b [0163.092] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZC3bMxJ8ob4oKd.docx" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zc3bmxj8ob4okd.docx")) returned 1 [0163.093] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", lpFilePart=0x0) returned 0x3a [0163.094] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", dwFileAttributes=0x80) returned 1 [0163.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv.Horsuke", lpFilePart=0x0) returned 0x42 [0163.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0163.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zxqtc99awlskhd.csv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.095] GetFileType (hFile=0x15c) returned 0x1 [0163.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0163.095] GetFileType (hFile=0x15c) returned 0x1 [0163.567] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", lpFilePart=0x0) returned 0x3a [0163.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0163.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zxqtc99awlskhd.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0163.568] GetFileType (hFile=0x23c) returned 0x1 [0163.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0163.568] GetFileType (hFile=0x23c) returned 0x1 [0163.568] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.573] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.573] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.573] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.575] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.575] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.575] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.575] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.575] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.576] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0163.576] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x6cb, lpOverlapped=0x0) returned 1 [0163.576] ReadFile (in: hFile=0x23c, lpBuffer=0x2319b0b, nNumberOfBytesToRead=0x135, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319b0b*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0163.576] ReadFile (in: hFile=0x23c, lpBuffer=0x2319c58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2319c58*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0163.576] CloseHandle (hObject=0x23c) returned 1 [0163.576] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv", lpFilePart=0x0) returned 0x3a [0163.576] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\ZxQtC99AwlsKhd.csv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\zxqtc99awlskhd.csv")) returned 1 [0163.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music", lpFilePart=0x0) returned 0x30 [0163.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\", lpFilePart=0x0) returned 0x31 [0163.578] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0xffffffffffffffff [0163.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0163.582] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0163.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.583] GetFileType (hFile=0x15c) returned 0x1 [0163.583] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.583] GetFileType (hFile=0x15c) returned 0x1 [0163.583] WriteFile (in: hFile=0x15c, lpBuffer=0x2334050*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2334050*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0163.584] CloseHandle (hObject=0x15c) returned 1 [0163.584] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.png", lpFilePart=0x0) returned 0x39 [0163.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0163.584] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.585] GetFileType (hFile=0x15c) returned 0x1 [0163.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0163.585] GetFileType (hFile=0x15c) returned 0x1 [0163.585] WriteFile (in: hFile=0x15c, lpBuffer=0x23350f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23350f8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0163.586] CloseHandle (hObject=0x15c) returned 1 [0163.586] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0163.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.586] GetFileType (hFile=0x15c) returned 0x1 [0163.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.586] GetFileType (hFile=0x15c) returned 0x1 [0163.586] WriteFile (in: hFile=0x15c, lpBuffer=0x2338c68*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2338c68*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0163.587] CloseHandle (hObject=0x15c) returned 1 [0163.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0163.587] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Music\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my music\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.587] GetFileType (hFile=0x15c) returned 0x1 [0163.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.588] GetFileType (hFile=0x15c) returned 0x1 [0163.588] WriteFile (in: hFile=0x15c, lpBuffer=0x233b658*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x233b658*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0163.588] CloseHandle (hObject=0x15c) returned 1 [0163.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures", lpFilePart=0x0) returned 0x33 [0163.589] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\", lpFilePart=0x0) returned 0x34 [0163.589] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0xffffffffffffffff [0163.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0163.592] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0163.592] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.592] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.593] GetFileType (hFile=0x15c) returned 0x1 [0163.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.593] GetFileType (hFile=0x15c) returned 0x1 [0163.593] WriteFile (in: hFile=0x15c, lpBuffer=0x2346d68*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2346d68*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0163.594] CloseHandle (hObject=0x15c) returned 1 [0163.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.png", lpFilePart=0x0) returned 0x3c [0163.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0163.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.596] GetFileType (hFile=0x15c) returned 0x1 [0163.596] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0163.596] GetFileType (hFile=0x15c) returned 0x1 [0163.596] WriteFile (in: hFile=0x15c, lpBuffer=0x2347e18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2347e18*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0163.597] CloseHandle (hObject=0x15c) returned 1 [0163.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0163.597] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.598] GetFileType (hFile=0x15c) returned 0x1 [0163.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.598] GetFileType (hFile=0x15c) returned 0x1 [0163.598] WriteFile (in: hFile=0x15c, lpBuffer=0x234b9a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x234b9a0*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0163.599] CloseHandle (hObject=0x15c) returned 1 [0163.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0163.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my pictures\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.600] GetFileType (hFile=0x15c) returned 0x1 [0163.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.600] GetFileType (hFile=0x15c) returned 0x1 [0163.600] WriteFile (in: hFile=0x15c, lpBuffer=0x234e3a0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x234e3a0*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0163.601] CloseHandle (hObject=0x15c) returned 1 [0163.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0163.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0163.601] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0163.601] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0163.602] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0163.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0163.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0163.602] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes", lpFilePart=0x0) returned 0x31 [0163.602] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\", lpFilePart=0x0) returned 0x32 [0163.602] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0163.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.602] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.603] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.603] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.603] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0163.603] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0163.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0163.603] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0163.603] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0163.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0163.603] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0163.603] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0163.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0163.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0163.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0163.617] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0163.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0163.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0163.617] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0163.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private", lpFilePart=0x0) returned 0x3a [0163.617] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\", lpFilePart=0x0) returned 0x3b [0163.617] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0163.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0163.617] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0163.618] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0163.618] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0163.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0163.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0163.621] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.TXT", lpFilePart=0x0) returned 0x43 [0163.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0163.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.622] GetFileType (hFile=0x15c) returned 0x1 [0163.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0163.622] GetFileType (hFile=0x15c) returned 0x1 [0163.623] WriteFile (in: hFile=0x15c, lpBuffer=0x235d148*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x235d148*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0163.623] CloseHandle (hObject=0x15c) returned 1 [0163.623] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.png", lpFilePart=0x0) returned 0x43 [0163.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0163.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.624] GetFileType (hFile=0x15c) returned 0x1 [0163.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0163.624] GetFileType (hFile=0x15c) returned 0x1 [0163.624] WriteFile (in: hFile=0x15c, lpBuffer=0x235e200*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x235e200*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0163.625] CloseHandle (hObject=0x15c) returned 1 [0163.625] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.vbs", lpFilePart=0x0) returned 0x43 [0163.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0163.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.625] GetFileType (hFile=0x15c) returned 0x1 [0163.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0163.626] GetFileType (hFile=0x15c) returned 0x1 [0163.626] WriteFile (in: hFile=0x15c, lpBuffer=0x2361da0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x2361da0*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0163.626] CloseHandle (hObject=0x15c) returned 1 [0163.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6f [0163.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0163.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\_private\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\_private\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.628] GetFileType (hFile=0x15c) returned 0x1 [0163.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0163.628] GetFileType (hFile=0x15c) returned 0x1 [0163.628] WriteFile (in: hFile=0x15c, lpBuffer=0x23647b0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23647b0*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0163.629] CloseHandle (hObject=0x15c) returned 1 [0163.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.TXT", lpFilePart=0x0) returned 0x3a [0163.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.630] GetFileType (hFile=0x15c) returned 0x1 [0163.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.630] GetFileType (hFile=0x15c) returned 0x1 [0163.630] WriteFile (in: hFile=0x15c, lpBuffer=0x236ea88*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x236ea88*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0163.631] CloseHandle (hObject=0x15c) returned 1 [0163.631] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.png", lpFilePart=0x0) returned 0x3a [0163.631] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0163.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.641] GetFileType (hFile=0x15c) returned 0x1 [0163.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0163.641] GetFileType (hFile=0x15c) returned 0x1 [0163.641] WriteFile (in: hFile=0x15c, lpBuffer=0x236fb30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x236fb30*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0163.642] CloseHandle (hObject=0x15c) returned 1 [0163.642] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.vbs", lpFilePart=0x0) returned 0x3a [0163.642] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.643] GetFileType (hFile=0x15c) returned 0x1 [0163.643] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.643] GetFileType (hFile=0x15c) returned 0x1 [0163.643] WriteFile (in: hFile=0x15c, lpBuffer=0x23736a0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x23736a0*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0163.643] CloseHandle (hObject=0x15c) returned 1 [0163.644] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x66 [0163.644] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Shapes\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my shapes\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.644] GetFileType (hFile=0x15c) returned 0x1 [0163.644] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.644] GetFileType (hFile=0x15c) returned 0x1 [0163.644] WriteFile (in: hFile=0x15c, lpBuffer=0x2376090*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2376090*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0163.645] CloseHandle (hObject=0x15c) returned 1 [0163.645] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos", lpFilePart=0x0) returned 0x31 [0163.645] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\", lpFilePart=0x0) returned 0x32 [0163.645] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0xffffffffffffffff [0163.646] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede40) returned 1 [0163.649] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.TXT", lpFilePart=0x0) returned 0x3a [0163.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.650] GetFileType (hFile=0x15c) returned 0x1 [0163.650] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.650] GetFileType (hFile=0x15c) returned 0x1 [0163.650] WriteFile (in: hFile=0x15c, lpBuffer=0x2381758*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2381758*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0163.651] CloseHandle (hObject=0x15c) returned 1 [0163.651] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.png", lpFilePart=0x0) returned 0x3a [0163.651] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0163.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.652] GetFileType (hFile=0x15c) returned 0x1 [0163.652] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0163.652] GetFileType (hFile=0x15c) returned 0x1 [0163.652] WriteFile (in: hFile=0x15c, lpBuffer=0x2382800*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2382800*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0163.653] CloseHandle (hObject=0x15c) returned 1 [0163.653] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.vbs", lpFilePart=0x0) returned 0x3a [0163.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.654] GetFileType (hFile=0x15c) returned 0x1 [0163.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.654] GetFileType (hFile=0x15c) returned 0x1 [0163.654] WriteFile (in: hFile=0x15c, lpBuffer=0x2386370*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x2386370*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0163.655] CloseHandle (hObject=0x15c) returned 1 [0163.655] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x66 [0163.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0163.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\My Videos\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\my videos\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0163.655] GetFileType (hFile=0x15c) returned 0x1 [0163.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0163.655] GetFileType (hFile=0x15c) returned 0x1 [0163.655] WriteFile (in: hFile=0x15c, lpBuffer=0x2388d60*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x2388d60*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0163.656] CloseHandle (hObject=0x15c) returned 1 [0163.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0163.656] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0163.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0163.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.657] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0163.657] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0163.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0163.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0163.657] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0163.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files", lpFilePart=0x0) returned 0x35 [0163.657] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\", lpFilePart=0x0) returned 0x36 [0163.657] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0163.658] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.658] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0163.658] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0163.658] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0163.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0163.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0163.658] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0163.658] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", dwFileAttributes=0x80) returned 1 [0163.659] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Horsuke", lpFilePart=0x0) returned 0x54 [0163.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0163.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0163.660] GetFileType (hFile=0x15c) returned 0x1 [0163.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0163.660] GetFileType (hFile=0x15c) returned 0x1 [0164.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0164.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0164.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0164.163] GetFileType (hFile=0x23c) returned 0x1 [0164.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0164.163] GetFileType (hFile=0x23c) returned 0x1 [0164.163] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.165] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.169] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.170] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.170] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.171] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.171] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.172] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.173] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.173] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.174] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.174] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.175] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.176] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.176] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.177] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.177] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.178] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.179] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.182] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.182] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.182] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.182] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.183] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.183] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.183] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.183] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.183] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.184] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.184] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.184] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.184] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.184] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.185] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.185] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.185] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.185] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.185] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.186] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.186] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.186] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.186] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.186] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.187] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.187] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.187] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.187] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.187] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.188] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.188] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.188] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.188] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.188] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.189] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.189] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.189] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.189] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.189] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.190] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.191] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.192] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0164.192] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x400, lpOverlapped=0x0) returned 1 [0164.192] ReadFile (in: hFile=0x23c, lpBuffer=0x2273fb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2273fb8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0164.193] CloseHandle (hObject=0x23c) returned 1 [0164.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst", lpFilePart=0x0) returned 0x4c [0164.193] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\voeimd@djhreuu.uhd.pst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\voeimd@djhreuu.uhd.pst")) returned 1 [0164.198] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.TXT", lpFilePart=0x0) returned 0x3e [0164.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.199] GetFileType (hFile=0x15c) returned 0x1 [0164.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.199] GetFileType (hFile=0x15c) returned 0x1 [0164.200] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.png", lpFilePart=0x0) returned 0x3e [0164.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0164.200] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.201] GetFileType (hFile=0x15c) returned 0x1 [0164.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0164.201] GetFileType (hFile=0x15c) returned 0x1 [0164.201] WriteFile (in: hFile=0x15c, lpBuffer=0x22c3158*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22c3158*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0164.202] CloseHandle (hObject=0x15c) returned 1 [0164.202] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.vbs", lpFilePart=0x0) returned 0x3e [0164.202] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.213] GetFileType (hFile=0x15c) returned 0x1 [0164.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.213] GetFileType (hFile=0x15c) returned 0x1 [0164.213] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6a [0164.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Outlook Files\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\outlook files\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.215] GetFileType (hFile=0x15c) returned 0x1 [0164.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.215] GetFileType (hFile=0x15c) returned 0x1 [0164.216] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0164.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.217] GetFileType (hFile=0x15c) returned 0x1 [0164.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.217] GetFileType (hFile=0x15c) returned 0x1 [0164.218] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.png", lpFilePart=0x0) returned 0x30 [0164.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0164.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.219] GetFileType (hFile=0x15c) returned 0x1 [0164.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0164.219] GetFileType (hFile=0x15c) returned 0x1 [0164.219] WriteFile (in: hFile=0x15c, lpBuffer=0x22d4a30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22d4a30*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0164.220] CloseHandle (hObject=0x15c) returned 1 [0164.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0164.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.220] GetFileType (hFile=0x15c) returned 0x1 [0164.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.220] GetFileType (hFile=0x15c) returned 0x1 [0164.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0164.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\documents\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.222] GetFileType (hFile=0x15c) returned 0x1 [0164.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.223] GetFileType (hFile=0x15c) returned 0x1 [0164.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0164.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0164.223] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0164.223] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0164.224] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.224] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.224] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0164.224] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0164.224] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0164.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0164.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads", lpFilePart=0x0) returned 0x27 [0164.224] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\", lpFilePart=0x0) returned 0x28 [0164.224] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0164.225] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.225] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.225] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0164.225] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0164.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0164.227] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0164.227] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.227] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.227] GetFileType (hFile=0x15c) returned 0x1 [0164.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.227] GetFileType (hFile=0x15c) returned 0x1 [0164.228] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.png", lpFilePart=0x0) returned 0x30 [0164.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0164.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.229] GetFileType (hFile=0x15c) returned 0x1 [0164.229] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0164.229] GetFileType (hFile=0x15c) returned 0x1 [0164.229] WriteFile (in: hFile=0x15c, lpBuffer=0x22e80b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22e80b8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0164.230] CloseHandle (hObject=0x15c) returned 1 [0164.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0164.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.230] GetFileType (hFile=0x15c) returned 0x1 [0164.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.230] GetFileType (hFile=0x15c) returned 0x1 [0164.231] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0164.231] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Downloads\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\downloads\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.289] GetFileType (hFile=0x15c) returned 0x1 [0164.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.289] GetFileType (hFile=0x15c) returned 0x1 [0164.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0164.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0164.290] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0164.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0164.290] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0164.291] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0164.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0164.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0164.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites", lpFilePart=0x0) returned 0x27 [0164.291] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\", lpFilePart=0x0) returned 0x28 [0164.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0164.292] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0164.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0164.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0164.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0164.293] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0164.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0164.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0164.293] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0164.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0164.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0164.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links", lpFilePart=0x0) returned 0x2d [0164.294] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\", lpFilePart=0x0) returned 0x2e [0164.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0164.294] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.294] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.294] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.294] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.294] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0164.294] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0164.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0164.295] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.TXT", lpFilePart=0x0) returned 0x36 [0164.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.296] GetFileType (hFile=0x15c) returned 0x1 [0164.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.296] GetFileType (hFile=0x15c) returned 0x1 [0164.297] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.png", lpFilePart=0x0) returned 0x36 [0164.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0164.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.310] GetFileType (hFile=0x15c) returned 0x1 [0164.310] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0164.310] GetFileType (hFile=0x15c) returned 0x1 [0164.310] WriteFile (in: hFile=0x15c, lpBuffer=0x22fedf0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22fedf0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0164.311] CloseHandle (hObject=0x15c) returned 1 [0164.311] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.vbs", lpFilePart=0x0) returned 0x36 [0164.311] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.312] GetFileType (hFile=0x15c) returned 0x1 [0164.312] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.312] GetFileType (hFile=0x15c) returned 0x1 [0164.313] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x62 [0164.313] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Links\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\links\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.314] GetFileType (hFile=0x15c) returned 0x1 [0164.314] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.314] GetFileType (hFile=0x15c) returned 0x1 [0164.314] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0164.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0164.315] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0164.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0164.327] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.327] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.327] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.327] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.327] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.328] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.328] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0164.328] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0164.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0164.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0164.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites", lpFilePart=0x0) returned 0x3a [0164.328] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\", lpFilePart=0x0) returned 0x3b [0164.329] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0164.329] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.330] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0164.330] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0164.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0164.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.TXT", lpFilePart=0x0) returned 0x43 [0164.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.332] GetFileType (hFile=0x15c) returned 0x1 [0164.333] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.333] GetFileType (hFile=0x15c) returned 0x1 [0164.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.png", lpFilePart=0x0) returned 0x43 [0164.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0164.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.334] GetFileType (hFile=0x15c) returned 0x1 [0164.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0164.334] GetFileType (hFile=0x15c) returned 0x1 [0164.334] WriteFile (in: hFile=0x15c, lpBuffer=0x2313e50*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2313e50*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0164.335] CloseHandle (hObject=0x15c) returned 1 [0164.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.vbs", lpFilePart=0x0) returned 0x43 [0164.335] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.337] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6f [0164.337] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.337] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Microsoft Websites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\microsoft websites\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0164.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0164.338] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0164.338] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0164.340] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.340] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.340] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.340] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.340] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.340] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.341] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.341] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0164.341] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0164.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0164.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0164.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites", lpFilePart=0x0) returned 0x34 [0164.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\", lpFilePart=0x0) returned 0x35 [0164.342] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0164.342] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0164.343] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0164.343] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0164.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0164.344] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.TXT", lpFilePart=0x0) returned 0x3d [0164.344] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.347] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.png", lpFilePart=0x0) returned 0x3d [0164.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0164.347] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0164.348] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.vbs", lpFilePart=0x0) returned 0x3d [0164.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.350] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x69 [0164.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0164.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\MSN Websites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\msn websites\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0164.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0164.353] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.355] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.png", lpFilePart=0x0) returned 0x30 [0164.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0164.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0164.356] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0164.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.358] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0164.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0164.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\favorites\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0164.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0164.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0164.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0164.359] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0164.359] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0164.359] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.360] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0164.360] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0164.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0164.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0164.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links", lpFilePart=0x0) returned 0x23 [0164.360] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\", lpFilePart=0x0) returned 0x24 [0164.360] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0164.361] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0164.361] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0164.361] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0164.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0164.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0164.361] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0164.361] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", dwFileAttributes=0x80) returned 1 [0164.380] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Horsuke", lpFilePart=0x0) returned 0x37 [0164.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0164.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0164.968] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0164.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0164.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0164.970] GetFileType (hFile=0x23c) returned 0x1 [0164.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0164.970] GetFileType (hFile=0x23c) returned 0x1 [0164.972] ReadFile (in: hFile=0x23c, lpBuffer=0x222d210, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d210*, lpNumberOfBytesRead=0x2edf68*=0x1e6, lpOverlapped=0x0) returned 1 [0164.974] ReadFile (in: hFile=0x23c, lpBuffer=0x222d210, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x222d210*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0164.974] CloseHandle (hObject=0x23c) returned 1 [0164.974] WriteFile (in: hFile=0x15c, lpBuffer=0x222b8f8*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x222b8f8*, lpNumberOfBytesWritten=0x2ede38*=0x210, lpOverlapped=0x0) returned 1 [0164.975] CloseHandle (hObject=0x15c) returned 1 [0164.975] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk", lpFilePart=0x0) returned 0x2f [0164.975] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Desktop.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\desktop.lnk")) returned 1 [0164.976] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0164.976] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", dwFileAttributes=0x80) returned 1 [0164.977] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Horsuke", lpFilePart=0x0) returned 0x39 [0164.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0164.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0164.978] GetFileType (hFile=0x15c) returned 0x1 [0164.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0164.979] GetFileType (hFile=0x15c) returned 0x1 [0165.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0165.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0165.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0165.535] GetFileType (hFile=0x23c) returned 0x1 [0165.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0165.535] GetFileType (hFile=0x23c) returned 0x1 [0165.535] ReadFile (in: hFile=0x23c, lpBuffer=0x2315aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2315aa0*, lpNumberOfBytesRead=0x2edf68*=0x3a1, lpOverlapped=0x0) returned 1 [0165.547] ReadFile (in: hFile=0x23c, lpBuffer=0x2315aa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2315aa0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0165.547] CloseHandle (hObject=0x23c) returned 1 [0165.547] WriteFile (in: hFile=0x15c, lpBuffer=0x2313fc8*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2313fc8*, lpNumberOfBytesWritten=0x2ede38*=0x3d0, lpOverlapped=0x0) returned 1 [0165.548] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk", lpFilePart=0x0) returned 0x31 [0165.548] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Downloads.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\downloads.lnk")) returned 1 [0165.549] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0165.549] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", dwFileAttributes=0x80) returned 1 [0165.594] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Horsuke", lpFilePart=0x0) returned 0x3c [0165.594] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0165.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0165.595] GetFileType (hFile=0x15c) returned 0x1 [0165.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0165.595] GetFileType (hFile=0x15c) returned 0x1 [0166.148] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0166.148] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0166.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0166.149] GetFileType (hFile=0x23c) returned 0x1 [0166.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0166.149] GetFileType (hFile=0x23c) returned 0x1 [0166.149] ReadFile (in: hFile=0x23c, lpBuffer=0x23fe670, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fe670*, lpNumberOfBytesRead=0x2edf68*=0x16b, lpOverlapped=0x0) returned 1 [0166.150] ReadFile (in: hFile=0x23c, lpBuffer=0x23fe670, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fe670*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0166.150] CloseHandle (hObject=0x23c) returned 1 [0166.150] WriteFile (in: hFile=0x15c, lpBuffer=0x23fcb88*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23fcb88*, lpNumberOfBytesWritten=0x2ede38*=0x190, lpOverlapped=0x0) returned 1 [0166.151] CloseHandle (hObject=0x15c) returned 1 [0166.151] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk", lpFilePart=0x0) returned 0x34 [0166.151] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\RecentPlaces.lnk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\recentplaces.lnk")) returned 1 [0166.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0166.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0166.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0166.155] GetFileType (hFile=0x15c) returned 0x1 [0166.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0166.155] GetFileType (hFile=0x15c) returned 0x1 [0166.156] WriteFile (in: hFile=0x15c, lpBuffer=0x2408b88*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2408b88*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0166.156] CloseHandle (hObject=0x15c) returned 1 [0166.157] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.png", lpFilePart=0x0) returned 0x2c [0166.157] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0166.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0166.157] GetFileType (hFile=0x15c) returned 0x1 [0166.157] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0166.157] GetFileType (hFile=0x15c) returned 0x1 [0166.157] WriteFile (in: hFile=0x15c, lpBuffer=0x2409c18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2409c18*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0166.158] CloseHandle (hObject=0x15c) returned 1 [0166.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0166.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0166.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0166.159] GetFileType (hFile=0x15c) returned 0x1 [0166.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0166.159] GetFileType (hFile=0x15c) returned 0x1 [0166.159] WriteFile (in: hFile=0x15c, lpBuffer=0x240d740*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x240d740*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0166.160] CloseHandle (hObject=0x15c) returned 1 [0166.160] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0166.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0166.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Links\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\links\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0166.162] GetFileType (hFile=0x15c) returned 0x1 [0166.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0166.162] GetFileType (hFile=0x15c) returned 0x1 [0166.162] WriteFile (in: hFile=0x15c, lpBuffer=0x2410100*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2410100*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0166.163] CloseHandle (hObject=0x15c) returned 1 [0166.163] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0166.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings", lpFilePart=0x0) returned 0x2c [0166.163] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\", lpFilePart=0x0) returned 0x2d [0166.163] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0166.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0166.168] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.TXT", lpFilePart=0x0) returned 0x35 [0166.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0166.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0166.169] GetFileType (hFile=0x15c) returned 0x1 [0166.170] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0166.170] GetFileType (hFile=0x15c) returned 0x1 [0166.170] WriteFile (in: hFile=0x15c, lpBuffer=0x241b768*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x241b768*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0166.172] CloseHandle (hObject=0x15c) returned 1 [0166.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.png", lpFilePart=0x0) returned 0x35 [0166.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0166.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0166.173] GetFileType (hFile=0x15c) returned 0x1 [0166.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0166.173] GetFileType (hFile=0x15c) returned 0x1 [0166.173] WriteFile (in: hFile=0x15c, lpBuffer=0x241c808*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x241c808*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0166.175] CloseHandle (hObject=0x15c) returned 1 [0166.175] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.vbs", lpFilePart=0x0) returned 0x35 [0166.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0166.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0166.175] GetFileType (hFile=0x15c) returned 0x1 [0166.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0166.175] GetFileType (hFile=0x15c) returned 0x1 [0166.175] WriteFile (in: hFile=0x15c, lpBuffer=0x2420360*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2420360*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0166.176] CloseHandle (hObject=0x15c) returned 1 [0166.176] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x61 [0166.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0166.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Local Settings\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\local settings\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0166.184] GetFileType (hFile=0x15c) returned 0x1 [0166.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0166.184] GetFileType (hFile=0x15c) returned 0x1 [0166.184] WriteFile (in: hFile=0x15c, lpBuffer=0x2422d40*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2422d40*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0166.186] CloseHandle (hObject=0x15c) returned 1 [0166.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0166.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0166.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0166.186] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0166.186] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.186] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.187] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.188] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.189] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0166.189] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0166.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0166.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0166.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0166.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music", lpFilePart=0x0) returned 0x23 [0166.189] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\", lpFilePart=0x0) returned 0x24 [0166.189] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0166.189] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.189] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.189] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.190] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.191] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.192] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.192] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.192] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.192] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.192] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0166.192] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0166.192] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0166.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0166.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0166.192] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", lpFilePart=0x0) returned 0x2c [0166.193] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", dwFileAttributes=0x80) returned 1 [0166.193] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x34 [0166.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0166.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0166.212] GetFileType (hFile=0x15c) returned 0x1 [0166.212] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0166.212] GetFileType (hFile=0x15c) returned 0x1 [0166.681] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", lpFilePart=0x0) returned 0x2c [0166.681] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0166.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0166.681] GetFileType (hFile=0x23c) returned 0x1 [0166.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0166.681] GetFileType (hFile=0x23c) returned 0x1 [0166.681] ReadFile (in: hFile=0x23c, lpBuffer=0x2312fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2312fc8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0166.682] ReadFile (in: hFile=0x23c, lpBuffer=0x2312fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2312fc8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0166.686] ReadFile (in: hFile=0x23c, lpBuffer=0x2312fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2312fc8*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0166.686] ReadFile (in: hFile=0x23c, lpBuffer=0x2312fc8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2312fc8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0166.686] CloseHandle (hObject=0x23c) returned 1 [0166.687] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", lpFilePart=0x0) returned 0x2c [0166.687] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.png")) returned 1 [0166.688] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", lpFilePart=0x0) returned 0x34 [0166.688] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", dwFileAttributes=0x80) returned 1 [0166.689] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a.Horsuke", lpFilePart=0x0) returned 0x3c [0166.689] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0166.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hgtf_x5po8uy.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0166.690] GetFileType (hFile=0x15c) returned 0x1 [0166.690] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0166.690] GetFileType (hFile=0x15c) returned 0x1 [0167.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", lpFilePart=0x0) returned 0x34 [0167.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0167.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hgtf_x5po8uy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0167.220] GetFileType (hFile=0x23c) returned 0x1 [0167.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0167.220] GetFileType (hFile=0x23c) returned 0x1 [0167.220] ReadFile (in: hFile=0x23c, lpBuffer=0x23fdc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fdc28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.227] ReadFile (in: hFile=0x23c, lpBuffer=0x23fdc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fdc28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.227] ReadFile (in: hFile=0x23c, lpBuffer=0x23fdc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fdc28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.227] ReadFile (in: hFile=0x23c, lpBuffer=0x23fdc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fdc28*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.228] ReadFile (in: hFile=0x23c, lpBuffer=0x23fdc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fdc28*, lpNumberOfBytesRead=0x2edf68*=0xa4b, lpOverlapped=0x0) returned 1 [0167.228] ReadFile (in: hFile=0x23c, lpBuffer=0x23fda5b, nNumberOfBytesToRead=0x1b5, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fda5b*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0167.228] ReadFile (in: hFile=0x23c, lpBuffer=0x23fdc28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23fdc28*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0167.228] CloseHandle (hObject=0x23c) returned 1 [0167.229] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a", lpFilePart=0x0) returned 0x34 [0167.229] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\hgTf_X5PO8UY.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hgtf_x5po8uy.m4a")) returned 1 [0167.230] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", lpFilePart=0x0) returned 0x36 [0167.230] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", dwFileAttributes=0x80) returned 1 [0167.232] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a.Horsuke", lpFilePart=0x0) returned 0x3e [0167.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0167.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\i05yoe-4w5vej5.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0167.233] GetFileType (hFile=0x15c) returned 0x1 [0167.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0167.233] GetFileType (hFile=0x15c) returned 0x1 [0167.815] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", lpFilePart=0x0) returned 0x36 [0167.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0167.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\i05yoe-4w5vej5.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0167.816] GetFileType (hFile=0x23c) returned 0x1 [0167.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0167.816] GetFileType (hFile=0x23c) returned 0x1 [0167.816] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.823] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0167.823] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x48f, lpOverlapped=0x0) returned 1 [0167.823] ReadFile (in: hFile=0x23c, lpBuffer=0x22ead17, nNumberOfBytesToRead=0x371, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ead17*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0167.823] ReadFile (in: hFile=0x23c, lpBuffer=0x22eb0a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22eb0a0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0167.823] CloseHandle (hObject=0x23c) returned 1 [0167.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a", lpFilePart=0x0) returned 0x36 [0167.823] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\i05yoe-4w5VEj5.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\i05yoe-4w5vej5.m4a")) returned 1 [0167.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", lpFilePart=0x0) returned 0x2f [0167.825] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", dwFileAttributes=0x80) returned 1 [0167.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a.Horsuke", lpFilePart=0x0) returned 0x37 [0167.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0167.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iaxmlpy.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0167.827] GetFileType (hFile=0x15c) returned 0x1 [0167.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0167.827] GetFileType (hFile=0x15c) returned 0x1 [0168.321] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", lpFilePart=0x0) returned 0x2f [0168.321] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0168.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iaxmlpy.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0168.322] GetFileType (hFile=0x23c) returned 0x1 [0168.322] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0168.322] GetFileType (hFile=0x23c) returned 0x1 [0168.322] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.327] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.328] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.328] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.328] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.328] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.328] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0xac9, lpOverlapped=0x0) returned 1 [0168.329] ReadFile (in: hFile=0x23c, lpBuffer=0x23ddf41, nNumberOfBytesToRead=0x137, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ddf41*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0168.329] ReadFile (in: hFile=0x23c, lpBuffer=0x23de090, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23de090*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0168.329] CloseHandle (hObject=0x23c) returned 1 [0168.329] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a", lpFilePart=0x0) returned 0x2f [0168.329] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\IaXMLpy.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\iaxmlpy.m4a")) returned 1 [0168.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", lpFilePart=0x0) returned 0x34 [0168.330] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", dwFileAttributes=0x80) returned 1 [0168.331] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a.Horsuke", lpFilePart=0x0) returned 0x3c [0168.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0168.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ojn5l6bqpwzp.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0168.332] GetFileType (hFile=0x15c) returned 0x1 [0168.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0168.332] GetFileType (hFile=0x15c) returned 0x1 [0168.814] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", lpFilePart=0x0) returned 0x34 [0168.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0168.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ojn5l6bqpwzp.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0168.815] GetFileType (hFile=0x23c) returned 0x1 [0168.816] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0168.816] GetFileType (hFile=0x23c) returned 0x1 [0168.816] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.820] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.821] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0168.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0xab1, lpOverlapped=0x0) returned 1 [0168.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd551, nNumberOfBytesToRead=0x14f, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd551*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0168.822] ReadFile (in: hFile=0x23c, lpBuffer=0x22cd6b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cd6b8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0168.822] CloseHandle (hObject=0x23c) returned 1 [0168.822] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a", lpFilePart=0x0) returned 0x34 [0168.822] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\OJN5l6bqPWZP.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\ojn5l6bqpwzp.m4a")) returned 1 [0168.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0168.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C", lpFilePart=0x0) returned 0x2f [0168.823] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\", lpFilePart=0x0) returned 0x30 [0168.823] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.824] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.825] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0168.825] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0168.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0168.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0168.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0168.825] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C", lpFilePart=0x0) returned 0x2f [0168.826] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\", lpFilePart=0x0) returned 0x30 [0168.826] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0168.826] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.826] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.826] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.826] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.826] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.826] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.827] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.828] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0168.828] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0168.828] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0168.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0168.828] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0168.828] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", lpFilePart=0x0) returned 0x48 [0168.828] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", dwFileAttributes=0x80) returned 1 [0168.831] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a.Horsuke", lpFilePart=0x0) returned 0x50 [0168.831] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0168.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\l6z1on6ehptwjmdy3ybh.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0168.832] GetFileType (hFile=0x15c) returned 0x1 [0168.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0168.832] GetFileType (hFile=0x15c) returned 0x1 [0169.330] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", lpFilePart=0x0) returned 0x48 [0169.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0169.330] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\l6z1on6ehptwjmdy3ybh.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0169.330] GetFileType (hFile=0x23c) returned 0x1 [0169.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0169.331] GetFileType (hFile=0x23c) returned 0x1 [0169.331] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.336] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.336] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.336] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.336] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.337] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.337] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.337] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.337] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.338] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.338] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.338] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.338] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.338] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.339] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.339] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.339] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.339] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.340] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x401, lpOverlapped=0x0) returned 1 [0169.340] ReadFile (in: hFile=0x23c, lpBuffer=0x23c2f81, nNumberOfBytesToRead=0x3ff, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c2f81*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0169.340] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23c3398*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0169.340] CloseHandle (hObject=0x23c) returned 1 [0169.340] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a", lpFilePart=0x0) returned 0x48 [0169.340] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\l6Z1on6EHptWjmDY3yBH.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\l6z1on6ehptwjmdy3ybh.m4a")) returned 1 [0169.341] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", lpFilePart=0x0) returned 0x46 [0169.341] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", dwFileAttributes=0x80) returned 1 [0169.342] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a.Horsuke", lpFilePart=0x0) returned 0x4e [0169.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0169.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\maza31 49l z7negxv.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0169.343] GetFileType (hFile=0x15c) returned 0x1 [0169.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0169.343] GetFileType (hFile=0x15c) returned 0x1 [0169.824] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", lpFilePart=0x0) returned 0x46 [0169.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0169.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\maza31 49l z7negxv.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0169.825] GetFileType (hFile=0x23c) returned 0x1 [0169.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0169.825] GetFileType (hFile=0x23c) returned 0x1 [0169.825] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.831] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.831] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.831] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.832] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.832] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.832] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.832] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.833] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.833] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.833] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.833] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.834] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.834] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.834] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0169.834] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0xe63, lpOverlapped=0x0) returned 1 [0169.835] ReadFile (in: hFile=0x23c, lpBuffer=0x22be62b, nNumberOfBytesToRead=0x19d, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be62b*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0169.835] ReadFile (in: hFile=0x23c, lpBuffer=0x22be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22be7e0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0169.835] CloseHandle (hObject=0x23c) returned 1 [0169.835] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a", lpFilePart=0x0) returned 0x46 [0169.835] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\mAZA31 49l Z7negXV.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\maza31 49l z7negxv.m4a")) returned 1 [0169.837] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", lpFilePart=0x0) returned 0x40 [0169.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", dwFileAttributes=0x80) returned 1 [0169.838] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a.Horsuke", lpFilePart=0x0) returned 0x48 [0169.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0169.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\pyj5nrlvls4h.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0169.839] GetFileType (hFile=0x15c) returned 0x1 [0169.839] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0169.839] GetFileType (hFile=0x15c) returned 0x1 [0170.374] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", lpFilePart=0x0) returned 0x40 [0170.374] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0170.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\pyj5nrlvls4h.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0170.375] GetFileType (hFile=0x23c) returned 0x1 [0170.375] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0170.375] GetFileType (hFile=0x23c) returned 0x1 [0170.375] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.381] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.381] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.382] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.382] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.382] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x15c, lpOverlapped=0x0) returned 1 [0170.383] ReadFile (in: hFile=0x23c, lpBuffer=0x23b7300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b7300*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0170.383] CloseHandle (hObject=0x23c) returned 1 [0170.383] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a", lpFilePart=0x0) returned 0x40 [0170.383] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\pYJ5NrlvLS4H.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\pyj5nrlvls4h.m4a")) returned 1 [0170.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", lpFilePart=0x0) returned 0x44 [0170.384] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", dwFileAttributes=0x80) returned 1 [0170.385] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a.Horsuke", lpFilePart=0x0) returned 0x4c [0170.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0170.385] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\z_ssfmo c0oxk9v9.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0170.386] GetFileType (hFile=0x15c) returned 0x1 [0170.386] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0170.386] GetFileType (hFile=0x15c) returned 0x1 [0170.866] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", lpFilePart=0x0) returned 0x44 [0170.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0170.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\z_ssfmo c0oxk9v9.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0170.867] GetFileType (hFile=0x23c) returned 0x1 [0170.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0170.867] GetFileType (hFile=0x23c) returned 0x1 [0170.867] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.869] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.872] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.872] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0170.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0xf83, lpOverlapped=0x0) returned 1 [0170.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22a45fb, nNumberOfBytesToRead=0x7d, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a45fb*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0170.873] ReadFile (in: hFile=0x23c, lpBuffer=0x22a4690, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a4690*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0170.873] CloseHandle (hObject=0x23c) returned 1 [0170.874] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a", lpFilePart=0x0) returned 0x44 [0170.874] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Z_ssFMO c0oXk9v9.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\z_ssfmo c0oxk9v9.m4a")) returned 1 [0170.875] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0170.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0170.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0170.876] GetFileType (hFile=0x15c) returned 0x1 [0170.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0170.876] GetFileType (hFile=0x15c) returned 0x1 [0170.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.png", lpFilePart=0x0) returned 0x38 [0170.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0170.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0170.877] GetFileType (hFile=0x15c) returned 0x1 [0170.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0170.877] GetFileType (hFile=0x15c) returned 0x1 [0170.877] WriteFile (in: hFile=0x15c, lpBuffer=0x22b5cf0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22b5cf0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0170.878] CloseHandle (hObject=0x15c) returned 1 [0170.878] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0170.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0170.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0170.879] GetFileType (hFile=0x15c) returned 0x1 [0170.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0170.879] GetFileType (hFile=0x15c) returned 0x1 [0170.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0170.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0170.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\dNN0VB8eU6C\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\dnn0vb8eu6c\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0170.880] GetFileType (hFile=0x15c) returned 0x1 [0170.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0170.880] GetFileType (hFile=0x15c) returned 0x1 [0170.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0170.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl", lpFilePart=0x0) returned 0x37 [0170.881] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\", lpFilePart=0x0) returned 0x38 [0170.881] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0170.881] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.881] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.882] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0170.882] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0170.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0170.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0170.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0170.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl", lpFilePart=0x0) returned 0x37 [0170.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\", lpFilePart=0x0) returned 0x38 [0170.883] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0170.883] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.883] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.883] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.883] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.883] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.883] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.884] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.884] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.884] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0170.884] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0170.884] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0170.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0170.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0170.884] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", lpFilePart=0x0) returned 0x47 [0170.885] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", dwFileAttributes=0x80) returned 1 [0170.886] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a.Horsuke", lpFilePart=0x0) returned 0x4f [0170.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0170.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\eke4kmbt4ox.m4a.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0170.886] GetFileType (hFile=0x15c) returned 0x1 [0170.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0170.887] GetFileType (hFile=0x15c) returned 0x1 [0171.396] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", lpFilePart=0x0) returned 0x47 [0171.396] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0171.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\eke4kmbt4ox.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0171.397] GetFileType (hFile=0x23c) returned 0x1 [0171.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0171.397] GetFileType (hFile=0x23c) returned 0x1 [0171.397] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.402] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.403] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.403] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.403] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.404] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.404] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.404] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.405] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.405] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.405] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.406] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0171.406] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x32f, lpOverlapped=0x0) returned 1 [0171.406] ReadFile (in: hFile=0x23c, lpBuffer=0x23a7850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a7850*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0171.406] CloseHandle (hObject=0x23c) returned 1 [0171.406] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a", lpFilePart=0x0) returned 0x47 [0171.406] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\EKe4kmBT4ox.m4a" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\eke4kmbt4ox.m4a")) returned 1 [0171.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.TXT", lpFilePart=0x0) returned 0x40 [0171.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0171.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.411] GetFileType (hFile=0x15c) returned 0x1 [0171.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0171.411] GetFileType (hFile=0x15c) returned 0x1 [0171.412] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.png", lpFilePart=0x0) returned 0x40 [0171.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0171.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0171.413] GetFileType (hFile=0x15c) returned 0x1 [0171.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0171.413] GetFileType (hFile=0x15c) returned 0x1 [0171.413] WriteFile (in: hFile=0x15c, lpBuffer=0x23bf520*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23bf520*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0171.414] CloseHandle (hObject=0x15c) returned 1 [0171.414] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.vbs", lpFilePart=0x0) returned 0x40 [0171.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0171.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.415] GetFileType (hFile=0x15c) returned 0x1 [0171.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0171.415] GetFileType (hFile=0x15c) returned 0x1 [0171.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6c [0171.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0171.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Z5YozQ-VNhpk2GyJIJl\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\z5yozq-vnhpk2gyjijl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.416] GetFileType (hFile=0x15c) returned 0x1 [0171.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0171.416] GetFileType (hFile=0x15c) returned 0x1 [0171.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0171.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.418] GetFileType (hFile=0x15c) returned 0x1 [0171.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.418] GetFileType (hFile=0x15c) returned 0x1 [0171.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png", lpFilePart=0x0) returned 0x2c [0171.419] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0171.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0171.419] GetFileType (hFile=0x15c) returned 0x1 [0171.419] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0171.419] GetFileType (hFile=0x15c) returned 0x1 [0171.419] WriteFile (in: hFile=0x15c, lpBuffer=0x23d0e08*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23d0e08*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0171.420] CloseHandle (hObject=0x15c) returned 1 [0171.420] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0171.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.420] GetFileType (hFile=0x15c) returned 0x1 [0171.420] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.420] GetFileType (hFile=0x15c) returned 0x1 [0171.422] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0171.422] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Music\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\music\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.423] GetFileType (hFile=0x15c) returned 0x1 [0171.423] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.423] GetFileType (hFile=0x15c) returned 0x1 [0171.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0171.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents", lpFilePart=0x0) returned 0x2a [0171.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\", lpFilePart=0x0) returned 0x2b [0171.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0171.424] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0171.528] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0171.528] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.529] GetFileType (hFile=0x15c) returned 0x1 [0171.529] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.529] GetFileType (hFile=0x15c) returned 0x1 [0171.529] WriteFile (in: hFile=0x15c, lpBuffer=0x23e2920*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23e2920*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0171.530] CloseHandle (hObject=0x15c) returned 1 [0171.530] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.png", lpFilePart=0x0) returned 0x33 [0171.530] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0171.530] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0171.531] GetFileType (hFile=0x15c) returned 0x1 [0171.531] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0171.531] GetFileType (hFile=0x15c) returned 0x1 [0171.531] WriteFile (in: hFile=0x15c, lpBuffer=0x23e39b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23e39b8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0171.532] CloseHandle (hObject=0x15c) returned 1 [0171.532] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0171.532] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.533] GetFileType (hFile=0x15c) returned 0x1 [0171.533] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.533] GetFileType (hFile=0x15c) returned 0x1 [0171.533] WriteFile (in: hFile=0x15c, lpBuffer=0x23e74f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23e74f8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0171.534] CloseHandle (hObject=0x15c) returned 1 [0171.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0171.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\My Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\my documents\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.534] GetFileType (hFile=0x15c) returned 0x1 [0171.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.535] GetFileType (hFile=0x15c) returned 0x1 [0171.535] WriteFile (in: hFile=0x15c, lpBuffer=0x23e9ec8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23e9ec8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0171.535] CloseHandle (hObject=0x15c) returned 1 [0171.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0171.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood", lpFilePart=0x0) returned 0x25 [0171.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\", lpFilePart=0x0) returned 0x26 [0171.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0171.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0171.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0171.540] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.541] GetFileType (hFile=0x15c) returned 0x1 [0171.541] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.541] GetFileType (hFile=0x15c) returned 0x1 [0171.541] WriteFile (in: hFile=0x15c, lpBuffer=0x23f5470*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23f5470*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0171.542] CloseHandle (hObject=0x15c) returned 1 [0171.542] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.png", lpFilePart=0x0) returned 0x2e [0171.542] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0171.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0171.543] GetFileType (hFile=0x15c) returned 0x1 [0171.543] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0171.543] GetFileType (hFile=0x15c) returned 0x1 [0171.544] WriteFile (in: hFile=0x15c, lpBuffer=0x23f6500*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23f6500*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0171.544] CloseHandle (hObject=0x15c) returned 1 [0171.544] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0171.544] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.545] GetFileType (hFile=0x15c) returned 0x1 [0171.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.545] GetFileType (hFile=0x15c) returned 0x1 [0171.546] WriteFile (in: hFile=0x15c, lpBuffer=0x23fa028*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23fa028*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0171.546] CloseHandle (hObject=0x15c) returned 1 [0171.546] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0171.546] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0171.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\NetHood\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\nethood\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0171.567] GetFileType (hFile=0x15c) returned 0x1 [0171.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0171.567] GetFileType (hFile=0x15c) returned 0x1 [0171.567] WriteFile (in: hFile=0x15c, lpBuffer=0x23fc9e8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23fc9e8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0171.568] CloseHandle (hObject=0x15c) returned 1 [0171.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0171.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0171.568] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0171.568] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0171.568] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.568] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.568] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.568] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.568] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.572] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.572] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.572] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0171.572] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0171.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0171.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0171.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0171.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures", lpFilePart=0x0) returned 0x26 [0171.572] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\", lpFilePart=0x0) returned 0x27 [0171.572] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0171.572] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.572] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.573] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.574] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.575] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0171.576] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0171.576] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0171.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0171.576] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0171.577] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", lpFilePart=0x0) returned 0x32 [0171.577] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", dwFileAttributes=0x80) returned 1 [0171.578] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg.Horsuke", lpFilePart=0x0) returned 0x3a [0171.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0171.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ddnmo_h.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0171.579] GetFileType (hFile=0x15c) returned 0x1 [0171.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0171.579] GetFileType (hFile=0x15c) returned 0x1 [0172.158] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", lpFilePart=0x0) returned 0x32 [0172.158] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0172.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ddnmo_h.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0172.159] GetFileType (hFile=0x23c) returned 0x1 [0172.159] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0172.159] GetFileType (hFile=0x23c) returned 0x1 [0172.159] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.165] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.166] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.166] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.166] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.167] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.167] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.167] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.168] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.168] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.168] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.169] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.169] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0xbf8, lpOverlapped=0x0) returned 1 [0172.169] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee190, nNumberOfBytesToRead=0x8, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee190*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0172.169] ReadFile (in: hFile=0x23c, lpBuffer=0x22ee1b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ee1b0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0172.169] CloseHandle (hObject=0x23c) returned 1 [0172.170] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg", lpFilePart=0x0) returned 0x32 [0172.170] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\ddNMO_h.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\ddnmo_h.jpg")) returned 1 [0172.172] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", lpFilePart=0x0) returned 0x31 [0172.172] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", dwFileAttributes=0x80) returned 1 [0172.173] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png.Horsuke", lpFilePart=0x0) returned 0x39 [0172.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0172.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eop91v.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0172.174] GetFileType (hFile=0x15c) returned 0x1 [0172.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0172.174] GetFileType (hFile=0x15c) returned 0x1 [0172.704] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", lpFilePart=0x0) returned 0x31 [0172.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0172.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eop91v.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0172.705] GetFileType (hFile=0x23c) returned 0x1 [0172.705] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0172.705] GetFileType (hFile=0x23c) returned 0x1 [0172.705] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.710] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.711] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.712] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.713] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.713] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.713] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.713] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.714] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.714] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0172.714] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x8e1, lpOverlapped=0x0) returned 1 [0172.714] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1849, nNumberOfBytesToRead=0x31f, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1849*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0172.714] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1b80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1b80*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0172.714] CloseHandle (hObject=0x23c) returned 1 [0172.714] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png", lpFilePart=0x0) returned 0x31 [0172.715] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\eop91v.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\eop91v.png")) returned 1 [0172.716] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", lpFilePart=0x0) returned 0x37 [0172.716] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", dwFileAttributes=0x80) returned 1 [0172.717] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg.Horsuke", lpFilePart=0x0) returned 0x3f [0172.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0172.717] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gh_kd_f9lesb.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0172.718] GetFileType (hFile=0x15c) returned 0x1 [0172.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0172.718] GetFileType (hFile=0x15c) returned 0x1 [0173.397] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", lpFilePart=0x0) returned 0x37 [0173.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0173.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gh_kd_f9lesb.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0173.398] GetFileType (hFile=0x23c) returned 0x1 [0173.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0173.398] GetFileType (hFile=0x23c) returned 0x1 [0173.398] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.404] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.404] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.404] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.404] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.405] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.405] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.405] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.405] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.405] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.406] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.406] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.406] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.406] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.407] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.407] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.407] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.407] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.408] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.408] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.408] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0xa6c, lpOverlapped=0x0) returned 1 [0173.408] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6c74, nNumberOfBytesToRead=0x194, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6c74*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0173.408] ReadFile (in: hFile=0x23c, lpBuffer=0x22b6e20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b6e20*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0173.408] CloseHandle (hObject=0x23c) returned 1 [0173.409] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg", lpFilePart=0x0) returned 0x37 [0173.409] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Gh_kd_F9LeSB.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gh_kd_f9lesb.jpg")) returned 1 [0173.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", lpFilePart=0x0) returned 0x38 [0173.411] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", dwFileAttributes=0x80) returned 1 [0173.411] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png.Horsuke", lpFilePart=0x0) returned 0x40 [0173.411] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0173.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gijdtpcfv25ot.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0173.496] GetFileType (hFile=0x15c) returned 0x1 [0173.496] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0173.496] GetFileType (hFile=0x15c) returned 0x1 [0173.982] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", lpFilePart=0x0) returned 0x38 [0173.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0173.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gijdtpcfv25ot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0173.983] GetFileType (hFile=0x23c) returned 0x1 [0173.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0173.983] GetFileType (hFile=0x23c) returned 0x1 [0173.984] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.989] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.989] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.989] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.989] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.990] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.990] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.990] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.990] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.991] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.991] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.991] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.991] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.991] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.992] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.992] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.992] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.992] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0173.993] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x35b, lpOverlapped=0x0) returned 1 [0173.993] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4850, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23b4850*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0173.993] CloseHandle (hObject=0x23c) returned 1 [0173.993] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png", lpFilePart=0x0) returned 0x38 [0173.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\GIjdtpCFv25oT.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\gijdtpcfv25ot.png")) returned 1 [0173.995] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", lpFilePart=0x0) returned 0x3a [0173.995] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", dwFileAttributes=0x80) returned 1 [0173.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg.Horsuke", lpFilePart=0x0) returned 0x42 [0173.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0173.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\glxgyavmwnxxwuf.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0173.997] GetFileType (hFile=0x15c) returned 0x1 [0173.997] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0173.997] GetFileType (hFile=0x15c) returned 0x1 [0174.615] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", lpFilePart=0x0) returned 0x3a [0174.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0174.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\glxgyavmwnxxwuf.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0174.616] GetFileType (hFile=0x23c) returned 0x1 [0174.616] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0174.616] GetFileType (hFile=0x23c) returned 0x1 [0174.617] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.623] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.623] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.624] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.624] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.624] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.625] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.625] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0174.625] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x663, lpOverlapped=0x0) returned 1 [0174.625] ReadFile (in: hFile=0x23c, lpBuffer=0x22af96b, nNumberOfBytesToRead=0x19d, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22af96b*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0174.626] ReadFile (in: hFile=0x23c, lpBuffer=0x22afb20, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22afb20*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0174.626] CloseHandle (hObject=0x23c) returned 1 [0174.626] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg", lpFilePart=0x0) returned 0x3a [0174.626] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\glXgYavMwNxXwUf.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\glxgyavmwnxxwuf.jpg")) returned 1 [0174.628] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", lpFilePart=0x0) returned 0x2f [0174.628] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", dwFileAttributes=0x80) returned 1 [0174.629] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x37 [0174.629] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0174.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0174.630] GetFileType (hFile=0x15c) returned 0x1 [0174.630] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0174.630] GetFileType (hFile=0x15c) returned 0x1 [0175.154] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", lpFilePart=0x0) returned 0x2f [0175.154] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0175.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0175.155] GetFileType (hFile=0x23c) returned 0x1 [0175.155] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0175.155] GetFileType (hFile=0x23c) returned 0x1 [0175.155] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0bf8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.160] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0bf8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.160] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0bf8*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0175.160] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23a0bf8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0175.160] CloseHandle (hObject=0x23c) returned 1 [0175.161] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", lpFilePart=0x0) returned 0x2f [0175.161] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.png")) returned 1 [0175.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", lpFilePart=0x0) returned 0x37 [0175.162] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", dwFileAttributes=0x80) returned 1 [0175.162] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg.Horsuke", lpFilePart=0x0) returned 0x3f [0175.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0175.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hhmuvkqm-d8a.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0175.163] GetFileType (hFile=0x15c) returned 0x1 [0175.163] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0175.163] GetFileType (hFile=0x15c) returned 0x1 [0175.715] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", lpFilePart=0x0) returned 0x37 [0175.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0175.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hhmuvkqm-d8a.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0175.716] GetFileType (hFile=0x23c) returned 0x1 [0175.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0175.716] GetFileType (hFile=0x23c) returned 0x1 [0175.717] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.723] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.724] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.724] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.724] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.725] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.725] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.725] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.726] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.726] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.726] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.727] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0175.727] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x39d, lpOverlapped=0x0) returned 1 [0175.727] ReadFile (in: hFile=0x23c, lpBuffer=0x228b900, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x228b900*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0175.727] CloseHandle (hObject=0x23c) returned 1 [0175.728] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg", lpFilePart=0x0) returned 0x37 [0175.728] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\hHMuvkqM-D8a.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hhmuvkqm-d8a.jpg")) returned 1 [0175.730] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", lpFilePart=0x0) returned 0x3c [0175.730] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", dwFileAttributes=0x80) returned 1 [0175.731] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png.Horsuke", lpFilePart=0x0) returned 0x44 [0175.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0175.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\j2r60_-mpf5tcehbo.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0175.732] GetFileType (hFile=0x15c) returned 0x1 [0175.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0175.732] GetFileType (hFile=0x15c) returned 0x1 [0176.242] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", lpFilePart=0x0) returned 0x3c [0176.242] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0176.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\j2r60_-mpf5tcehbo.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0176.242] GetFileType (hFile=0x23c) returned 0x1 [0176.242] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0176.242] GetFileType (hFile=0x23c) returned 0x1 [0176.242] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.247] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.248] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.248] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.248] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.248] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.248] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.249] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.249] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.249] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.249] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.249] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x258, lpOverlapped=0x0) returned 1 [0176.250] ReadFile (in: hFile=0x23c, lpBuffer=0x2380958, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2380958*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0176.250] CloseHandle (hObject=0x23c) returned 1 [0176.250] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png", lpFilePart=0x0) returned 0x3c [0176.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\J2r60_-mpF5TCEhbo.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\j2r60_-mpf5tcehbo.png")) returned 1 [0176.251] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", lpFilePart=0x0) returned 0x30 [0176.251] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", dwFileAttributes=0x80) returned 1 [0176.252] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png.Horsuke", lpFilePart=0x0) returned 0x38 [0176.252] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0176.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kga0x.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0176.253] GetFileType (hFile=0x15c) returned 0x1 [0176.253] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0176.253] GetFileType (hFile=0x15c) returned 0x1 [0176.718] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", lpFilePart=0x0) returned 0x30 [0176.718] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0176.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kga0x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0176.719] GetFileType (hFile=0x23c) returned 0x1 [0176.719] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0176.719] GetFileType (hFile=0x23c) returned 0x1 [0176.719] ReadFile (in: hFile=0x23c, lpBuffer=0x2274848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2274848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.724] ReadFile (in: hFile=0x23c, lpBuffer=0x2274848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2274848*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0176.724] ReadFile (in: hFile=0x23c, lpBuffer=0x2274848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2274848*, lpNumberOfBytesRead=0x2edf68*=0xb6d, lpOverlapped=0x0) returned 1 [0176.724] ReadFile (in: hFile=0x23c, lpBuffer=0x227479d, nNumberOfBytesToRead=0x93, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x227479d*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0176.724] ReadFile (in: hFile=0x23c, lpBuffer=0x2274848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2274848*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0176.724] CloseHandle (hObject=0x23c) returned 1 [0176.724] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png", lpFilePart=0x0) returned 0x30 [0176.724] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\kGa0X.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\kga0x.png")) returned 1 [0176.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", lpFilePart=0x0) returned 0x37 [0176.726] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", dwFileAttributes=0x80) returned 1 [0176.726] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png.Horsuke", lpFilePart=0x0) returned 0x3f [0176.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0176.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\khvc4 qc4txw.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0176.727] GetFileType (hFile=0x15c) returned 0x1 [0176.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0176.727] GetFileType (hFile=0x15c) returned 0x1 [0177.210] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", lpFilePart=0x0) returned 0x37 [0177.210] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0177.210] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\khvc4 qc4txw.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0177.211] GetFileType (hFile=0x23c) returned 0x1 [0177.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0177.211] GetFileType (hFile=0x23c) returned 0x1 [0177.211] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.212] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.216] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.216] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.217] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.217] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.217] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.217] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.218] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.218] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.218] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.218] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x50f, lpOverlapped=0x0) returned 1 [0177.218] ReadFile (in: hFile=0x23c, lpBuffer=0x235f947, nNumberOfBytesToRead=0x2f1, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235f947*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0177.218] ReadFile (in: hFile=0x23c, lpBuffer=0x235fc50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x235fc50*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0177.218] CloseHandle (hObject=0x23c) returned 1 [0177.219] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png", lpFilePart=0x0) returned 0x37 [0177.219] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\KHvc4 qC4tXw.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\khvc4 qc4txw.png")) returned 1 [0177.220] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", lpFilePart=0x0) returned 0x31 [0177.220] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", dwFileAttributes=0x80) returned 1 [0177.221] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png.Horsuke", lpFilePart=0x0) returned 0x39 [0177.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0177.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nlbnbp.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0177.222] GetFileType (hFile=0x15c) returned 0x1 [0177.222] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0177.222] GetFileType (hFile=0x15c) returned 0x1 [0177.694] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", lpFilePart=0x0) returned 0x31 [0177.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0177.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nlbnbp.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0177.695] GetFileType (hFile=0x23c) returned 0x1 [0177.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0177.695] GetFileType (hFile=0x23c) returned 0x1 [0177.695] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.700] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.701] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.702] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.702] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.702] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.703] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.704] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0xa10, lpOverlapped=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2253bd0, nNumberOfBytesToRead=0x1f0, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253bd0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0177.705] ReadFile (in: hFile=0x23c, lpBuffer=0x2253dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2253dd8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0177.705] CloseHandle (hObject=0x23c) returned 1 [0177.705] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png", lpFilePart=0x0) returned 0x31 [0177.705] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\NlBNBp.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\nlbnbp.png")) returned 1 [0177.707] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", lpFilePart=0x0) returned 0x3a [0177.707] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", dwFileAttributes=0x80) returned 1 [0177.708] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png.Horsuke", lpFilePart=0x0) returned 0x42 [0177.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0177.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oybvzbnorf_bisy.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0177.708] GetFileType (hFile=0x15c) returned 0x1 [0177.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0177.709] GetFileType (hFile=0x15c) returned 0x1 [0178.179] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", lpFilePart=0x0) returned 0x3a [0178.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0178.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oybvzbnorf_bisy.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0178.180] GetFileType (hFile=0x23c) returned 0x1 [0178.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0178.180] GetFileType (hFile=0x23c) returned 0x1 [0178.180] ReadFile (in: hFile=0x23c, lpBuffer=0x23527f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23527f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0178.185] ReadFile (in: hFile=0x23c, lpBuffer=0x23527f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23527f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0178.186] ReadFile (in: hFile=0x23c, lpBuffer=0x23527f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23527f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0178.186] ReadFile (in: hFile=0x23c, lpBuffer=0x23527f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23527f0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0178.186] ReadFile (in: hFile=0x23c, lpBuffer=0x23527f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23527f0*, lpNumberOfBytesRead=0x2edf68*=0x21e, lpOverlapped=0x0) returned 1 [0178.186] ReadFile (in: hFile=0x23c, lpBuffer=0x23527f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23527f0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0178.186] CloseHandle (hObject=0x23c) returned 1 [0178.186] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png", lpFilePart=0x0) returned 0x3a [0178.186] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\OybVZbnORf_BiSY.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\oybvzbnorf_bisy.png")) returned 1 [0178.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", lpFilePart=0x0) returned 0x3b [0178.188] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", dwFileAttributes=0x80) returned 1 [0178.188] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png.Horsuke", lpFilePart=0x0) returned 0x43 [0178.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0178.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tgzxqsjvarcl3y_x.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0178.189] GetFileType (hFile=0x15c) returned 0x1 [0178.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0178.189] GetFileType (hFile=0x15c) returned 0x1 [0178.794] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", lpFilePart=0x0) returned 0x3b [0178.794] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0178.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tgzxqsjvarcl3y_x.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0178.795] GetFileType (hFile=0x23c) returned 0x1 [0178.795] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0178.795] GetFileType (hFile=0x23c) returned 0x1 [0178.795] ReadFile (in: hFile=0x23c, lpBuffer=0x223f4c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x223f4c8*, lpNumberOfBytesRead=0x2edf68*=0xf03, lpOverlapped=0x0) returned 1 [0178.799] ReadFile (in: hFile=0x23c, lpBuffer=0x223f3b3, nNumberOfBytesToRead=0xfd, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x223f3b3*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0178.800] ReadFile (in: hFile=0x23c, lpBuffer=0x223f4c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x223f4c8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0178.800] CloseHandle (hObject=0x23c) returned 1 [0178.801] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png", lpFilePart=0x0) returned 0x3b [0178.801] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\TgZxqSJVaRcl3Y_x.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\tgzxqsjvarcl3y_x.png")) returned 1 [0178.802] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", lpFilePart=0x0) returned 0x3f [0178.802] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", dwFileAttributes=0x80) returned 1 [0178.803] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg.Horsuke", lpFilePart=0x0) returned 0x47 [0178.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0178.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\u2rqvzny91v_wvgoxac5.jpg.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0178.804] GetFileType (hFile=0x15c) returned 0x1 [0178.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0178.804] GetFileType (hFile=0x15c) returned 0x1 [0179.325] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", lpFilePart=0x0) returned 0x3f [0179.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0179.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\u2rqvzny91v_wvgoxac5.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0179.326] GetFileType (hFile=0x23c) returned 0x1 [0179.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0179.326] GetFileType (hFile=0x23c) returned 0x1 [0179.326] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.330] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.331] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.332] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.332] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.332] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.332] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.332] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.333] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.333] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.333] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x137, lpOverlapped=0x0) returned 1 [0179.333] ReadFile (in: hFile=0x23c, lpBuffer=0x2328c88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x2328c88*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0179.333] CloseHandle (hObject=0x23c) returned 1 [0179.333] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg", lpFilePart=0x0) returned 0x3f [0179.333] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\U2RQvzNy91v_WVgoxAc5.jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\u2rqvzny91v_wvgoxac5.jpg")) returned 1 [0179.335] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", lpFilePart=0x0) returned 0x32 [0179.335] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", dwFileAttributes=0x80) returned 1 [0179.336] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png.Horsuke", lpFilePart=0x0) returned 0x3a [0179.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0179.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uvpmh2n.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0179.336] GetFileType (hFile=0x15c) returned 0x1 [0179.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0179.337] GetFileType (hFile=0x15c) returned 0x1 [0179.857] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", lpFilePart=0x0) returned 0x32 [0179.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0179.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uvpmh2n.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0179.858] GetFileType (hFile=0x23c) returned 0x1 [0179.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0179.858] GetFileType (hFile=0x23c) returned 0x1 [0179.858] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.863] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.864] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.864] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.864] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.864] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.864] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.865] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.865] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.865] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.865] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.866] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.866] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.866] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.866] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.867] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0179.867] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0xa7, lpOverlapped=0x0) returned 1 [0179.867] ReadFile (in: hFile=0x23c, lpBuffer=0x241b978, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x241b978*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0179.867] CloseHandle (hObject=0x23c) returned 1 [0179.867] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png", lpFilePart=0x0) returned 0x32 [0179.867] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UVPmH2N.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uvpmh2n.png")) returned 1 [0179.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", lpFilePart=0x0) returned 0x37 [0179.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", dwFileAttributes=0x80) returned 1 [0179.869] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png.Horsuke", lpFilePart=0x0) returned 0x3f [0179.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0179.870] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xd0jjgsh-4tr.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0179.870] GetFileType (hFile=0x15c) returned 0x1 [0179.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0179.870] GetFileType (hFile=0x15c) returned 0x1 [0180.353] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", lpFilePart=0x0) returned 0x37 [0180.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0180.354] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xd0jjgsh-4tr.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0180.354] GetFileType (hFile=0x23c) returned 0x1 [0180.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0180.354] GetFileType (hFile=0x23c) returned 0x1 [0180.354] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.359] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.359] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.360] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.360] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.360] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.360] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.361] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.361] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.361] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.361] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.361] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.362] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.362] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.362] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.362] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.362] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.363] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.363] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.363] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0180.363] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0xe52, lpOverlapped=0x0) returned 1 [0180.363] ReadFile (in: hFile=0x23c, lpBuffer=0x23146f2, nNumberOfBytesToRead=0x1ae, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23146f2*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0180.364] ReadFile (in: hFile=0x23c, lpBuffer=0x23148b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23148b8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0180.364] CloseHandle (hObject=0x23c) returned 1 [0180.364] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png", lpFilePart=0x0) returned 0x37 [0180.364] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\xD0JjGSH-4TR.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\xd0jjgsh-4tr.png")) returned 1 [0180.366] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.TXT", lpFilePart=0x0) returned 0x2f [0180.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.367] GetFileType (hFile=0x15c) returned 0x1 [0180.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.367] GetFileType (hFile=0x15c) returned 0x1 [0180.367] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png", lpFilePart=0x0) returned 0x2f [0180.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.368] GetFileType (hFile=0x15c) returned 0x1 [0180.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.368] GetFileType (hFile=0x15c) returned 0x1 [0180.368] WriteFile (in: hFile=0x15c, lpBuffer=0x2335348*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2335348*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.369] CloseHandle (hObject=0x15c) returned 1 [0180.369] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.vbs", lpFilePart=0x0) returned 0x2f [0180.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.369] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.369] GetFileType (hFile=0x15c) returned 0x1 [0180.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.369] GetFileType (hFile=0x15c) returned 0x1 [0180.370] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5b [0180.370] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\pictures\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.370] GetFileType (hFile=0x15c) returned 0x1 [0180.370] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.370] GetFileType (hFile=0x15c) returned 0x1 [0180.371] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood", lpFilePart=0x0) returned 0x27 [0180.371] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\", lpFilePart=0x0) returned 0x28 [0180.371] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0180.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0180.375] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0180.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.377] GetFileType (hFile=0x15c) returned 0x1 [0180.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.377] GetFileType (hFile=0x15c) returned 0x1 [0180.377] WriteFile (in: hFile=0x15c, lpBuffer=0x2346e20*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2346e20*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.378] CloseHandle (hObject=0x15c) returned 1 [0180.378] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.png", lpFilePart=0x0) returned 0x30 [0180.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.379] GetFileType (hFile=0x15c) returned 0x1 [0180.379] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.379] GetFileType (hFile=0x15c) returned 0x1 [0180.379] WriteFile (in: hFile=0x15c, lpBuffer=0x2347eb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2347eb8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.381] CloseHandle (hObject=0x15c) returned 1 [0180.382] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0180.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.382] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.383] GetFileType (hFile=0x15c) returned 0x1 [0180.383] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.383] GetFileType (hFile=0x15c) returned 0x1 [0180.383] WriteFile (in: hFile=0x15c, lpBuffer=0x234b9f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x234b9f8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.384] CloseHandle (hObject=0x15c) returned 1 [0180.384] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0180.384] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\PrintHood\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\printhood\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.392] GetFileType (hFile=0x15c) returned 0x1 [0180.392] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.392] GetFileType (hFile=0x15c) returned 0x1 [0180.393] WriteFile (in: hFile=0x15c, lpBuffer=0x234e3c8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x234e3c8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.393] CloseHandle (hObject=0x15c) returned 1 [0180.394] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent", lpFilePart=0x0) returned 0x24 [0180.394] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\", lpFilePart=0x0) returned 0x25 [0180.394] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0180.394] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0180.398] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0180.398] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.399] GetFileType (hFile=0x15c) returned 0x1 [0180.399] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.399] GetFileType (hFile=0x15c) returned 0x1 [0180.399] WriteFile (in: hFile=0x15c, lpBuffer=0x2359970*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2359970*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.400] CloseHandle (hObject=0x15c) returned 1 [0180.400] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.png", lpFilePart=0x0) returned 0x2d [0180.400] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.400] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.401] GetFileType (hFile=0x15c) returned 0x1 [0180.401] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.401] GetFileType (hFile=0x15c) returned 0x1 [0180.401] WriteFile (in: hFile=0x15c, lpBuffer=0x235aa00*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x235aa00*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.402] CloseHandle (hObject=0x15c) returned 1 [0180.402] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0180.402] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.403] GetFileType (hFile=0x15c) returned 0x1 [0180.403] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.403] GetFileType (hFile=0x15c) returned 0x1 [0180.404] WriteFile (in: hFile=0x15c, lpBuffer=0x235e528*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x235e528*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.404] CloseHandle (hObject=0x15c) returned 1 [0180.404] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0180.404] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Recent\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\recent\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.405] GetFileType (hFile=0x15c) returned 0x1 [0180.406] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.406] GetFileType (hFile=0x15c) returned 0x1 [0180.406] WriteFile (in: hFile=0x15c, lpBuffer=0x2360ee8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2360ee8*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.406] CloseHandle (hObject=0x15c) returned 1 [0180.407] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29 [0180.407] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a [0180.407] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0180.407] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.407] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.407] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0180.407] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0180.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0180.407] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0180.408] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games", lpFilePart=0x0) returned 0x29 [0180.408] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\", lpFilePart=0x0) returned 0x2a [0180.408] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0180.408] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.408] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0180.408] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0180.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0180.408] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0180.410] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0180.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.411] GetFileType (hFile=0x15c) returned 0x1 [0180.411] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.412] GetFileType (hFile=0x15c) returned 0x1 [0180.412] WriteFile (in: hFile=0x15c, lpBuffer=0x236d028*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x236d028*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.414] CloseHandle (hObject=0x15c) returned 1 [0180.415] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.png", lpFilePart=0x0) returned 0x32 [0180.415] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.415] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.416] GetFileType (hFile=0x15c) returned 0x1 [0180.416] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.416] GetFileType (hFile=0x15c) returned 0x1 [0180.416] WriteFile (in: hFile=0x15c, lpBuffer=0x236e0c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x236e0c0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.417] CloseHandle (hObject=0x15c) returned 1 [0180.417] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0180.417] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.417] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.418] GetFileType (hFile=0x15c) returned 0x1 [0180.418] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.418] GetFileType (hFile=0x15c) returned 0x1 [0180.419] WriteFile (in: hFile=0x15c, lpBuffer=0x2371c00*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2371c00*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.419] CloseHandle (hObject=0x15c) returned 1 [0180.419] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0180.420] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Saved Games\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\saved games\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.422] GetFileType (hFile=0x15c) returned 0x1 [0180.422] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.422] GetFileType (hFile=0x15c) returned 0x1 [0180.422] WriteFile (in: hFile=0x15c, lpBuffer=0x23745d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23745d0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.424] CloseHandle (hObject=0x15c) returned 1 [0180.424] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26 [0180.424] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27 [0180.424] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0180.424] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.424] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0180.425] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0180.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0180.425] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0180.425] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches", lpFilePart=0x0) returned 0x26 [0180.425] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\", lpFilePart=0x0) returned 0x27 [0180.425] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0180.425] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.425] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.426] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0180.426] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0180.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0180.426] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0180.426] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.TXT", lpFilePart=0x0) returned 0x2f [0180.426] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.427] GetFileType (hFile=0x15c) returned 0x1 [0180.427] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.427] GetFileType (hFile=0x15c) returned 0x1 [0180.428] WriteFile (in: hFile=0x15c, lpBuffer=0x2380f58*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2380f58*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.434] CloseHandle (hObject=0x15c) returned 1 [0180.434] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.png", lpFilePart=0x0) returned 0x2f [0180.434] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.435] GetFileType (hFile=0x15c) returned 0x1 [0180.435] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.435] GetFileType (hFile=0x15c) returned 0x1 [0180.435] WriteFile (in: hFile=0x15c, lpBuffer=0x2381fe8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2381fe8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.436] CloseHandle (hObject=0x15c) returned 1 [0180.436] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.vbs", lpFilePart=0x0) returned 0x2f [0180.436] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.437] GetFileType (hFile=0x15c) returned 0x1 [0180.437] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.437] GetFileType (hFile=0x15c) returned 0x1 [0180.437] WriteFile (in: hFile=0x15c, lpBuffer=0x2385b10*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2385b10*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.438] CloseHandle (hObject=0x15c) returned 1 [0180.438] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5b [0180.438] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Searches\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\searches\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.439] GetFileType (hFile=0x15c) returned 0x1 [0180.439] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.439] GetFileType (hFile=0x15c) returned 0x1 [0180.439] WriteFile (in: hFile=0x15c, lpBuffer=0x23884d0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23884d0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.440] CloseHandle (hObject=0x15c) returned 1 [0180.440] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo", lpFilePart=0x0) returned 0x24 [0180.440] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\", lpFilePart=0x0) returned 0x25 [0180.440] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0180.440] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0180.444] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0180.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.446] GetFileType (hFile=0x15c) returned 0x1 [0180.446] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.446] GetFileType (hFile=0x15c) returned 0x1 [0180.447] WriteFile (in: hFile=0x15c, lpBuffer=0x2393a78*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x2393a78*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.447] CloseHandle (hObject=0x15c) returned 1 [0180.448] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.png", lpFilePart=0x0) returned 0x2d [0180.448] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.448] GetFileType (hFile=0x15c) returned 0x1 [0180.448] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.448] GetFileType (hFile=0x15c) returned 0x1 [0180.448] WriteFile (in: hFile=0x15c, lpBuffer=0x2394b08*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x2394b08*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.449] CloseHandle (hObject=0x15c) returned 1 [0180.449] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0180.449] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.450] GetFileType (hFile=0x15c) returned 0x1 [0180.450] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.450] GetFileType (hFile=0x15c) returned 0x1 [0180.450] WriteFile (in: hFile=0x15c, lpBuffer=0x2398630*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x2398630*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.451] CloseHandle (hObject=0x15c) returned 1 [0180.451] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0180.451] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\SendTo\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\sendto\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.451] GetFileType (hFile=0x15c) returned 0x1 [0180.451] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.451] GetFileType (hFile=0x15c) returned 0x1 [0180.451] WriteFile (in: hFile=0x15c, lpBuffer=0x239aff0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x239aff0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.452] CloseHandle (hObject=0x15c) returned 1 [0180.452] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu", lpFilePart=0x0) returned 0x28 [0180.452] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\", lpFilePart=0x0) returned 0x29 [0180.452] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0180.453] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0180.456] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.TXT", lpFilePart=0x0) returned 0x31 [0180.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.457] GetFileType (hFile=0x15c) returned 0x1 [0180.457] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.457] GetFileType (hFile=0x15c) returned 0x1 [0180.458] WriteFile (in: hFile=0x15c, lpBuffer=0x23a65f8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23a65f8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.458] CloseHandle (hObject=0x15c) returned 1 [0180.459] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.png", lpFilePart=0x0) returned 0x31 [0180.459] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.460] GetFileType (hFile=0x15c) returned 0x1 [0180.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.460] GetFileType (hFile=0x15c) returned 0x1 [0180.460] WriteFile (in: hFile=0x15c, lpBuffer=0x23a7690*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23a7690*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.461] CloseHandle (hObject=0x15c) returned 1 [0180.461] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.vbs", lpFilePart=0x0) returned 0x31 [0180.461] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.462] GetFileType (hFile=0x15c) returned 0x1 [0180.462] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.462] GetFileType (hFile=0x15c) returned 0x1 [0180.463] WriteFile (in: hFile=0x15c, lpBuffer=0x23ab1d0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23ab1d0*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.463] CloseHandle (hObject=0x15c) returned 1 [0180.464] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5d [0180.464] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.464] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Start Menu\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\start menu\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.474] GetFileType (hFile=0x15c) returned 0x1 [0180.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.474] GetFileType (hFile=0x15c) returned 0x1 [0180.474] WriteFile (in: hFile=0x15c, lpBuffer=0x23adba0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23adba0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.475] CloseHandle (hObject=0x15c) returned 1 [0180.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates", lpFilePart=0x0) returned 0x27 [0180.475] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\", lpFilePart=0x0) returned 0x28 [0180.475] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0180.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0180.479] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0180.479] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.480] GetFileType (hFile=0x15c) returned 0x1 [0180.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.480] GetFileType (hFile=0x15c) returned 0x1 [0180.480] WriteFile (in: hFile=0x15c, lpBuffer=0x23b9190*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23b9190*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0180.481] CloseHandle (hObject=0x15c) returned 1 [0180.481] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.png", lpFilePart=0x0) returned 0x30 [0180.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0180.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.482] GetFileType (hFile=0x15c) returned 0x1 [0180.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0180.482] GetFileType (hFile=0x15c) returned 0x1 [0180.482] WriteFile (in: hFile=0x15c, lpBuffer=0x23ba228*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23ba228*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0180.483] CloseHandle (hObject=0x15c) returned 1 [0180.483] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0180.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.483] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.484] GetFileType (hFile=0x15c) returned 0x1 [0180.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.484] GetFileType (hFile=0x15c) returned 0x1 [0180.484] WriteFile (in: hFile=0x15c, lpBuffer=0x23bdd68*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23bdd68*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0180.485] CloseHandle (hObject=0x15c) returned 1 [0180.485] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0180.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0180.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Templates\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\templates\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0180.487] GetFileType (hFile=0x15c) returned 0x1 [0180.487] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0180.487] GetFileType (hFile=0x15c) returned 0x1 [0180.488] WriteFile (in: hFile=0x15c, lpBuffer=0x23c0738*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23c0738*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0180.488] CloseHandle (hObject=0x15c) returned 1 [0180.488] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0180.488] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0180.488] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.489] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.490] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.490] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.490] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0180.490] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0180.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0180.490] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0180.490] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0180.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos", lpFilePart=0x0) returned 0x24 [0180.490] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\", lpFilePart=0x0) returned 0x25 [0180.490] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0180.490] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.490] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.491] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0180.492] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0180.492] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0180.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0180.492] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0180.492] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", lpFilePart=0x0) returned 0x2d [0180.492] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", dwFileAttributes=0x80) returned 1 [0180.493] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x35 [0180.493] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0180.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0180.494] GetFileType (hFile=0x15c) returned 0x1 [0180.494] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0180.494] GetFileType (hFile=0x15c) returned 0x1 [0181.008] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", lpFilePart=0x0) returned 0x2d [0181.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0181.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0181.008] GetFileType (hFile=0x23c) returned 0x1 [0181.008] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0181.008] GetFileType (hFile=0x23c) returned 0x1 [0181.008] ReadFile (in: hFile=0x23c, lpBuffer=0x22ad580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ad580*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0181.013] ReadFile (in: hFile=0x23c, lpBuffer=0x22ad580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ad580*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0181.013] ReadFile (in: hFile=0x23c, lpBuffer=0x22ad580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ad580*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0181.014] ReadFile (in: hFile=0x23c, lpBuffer=0x22ad580, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22ad580*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0181.014] CloseHandle (hObject=0x23c) returned 1 [0181.014] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", lpFilePart=0x0) returned 0x2d [0181.014] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.png")) returned 1 [0181.015] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0181.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24", lpFilePart=0x0) returned 0x34 [0181.015] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\", lpFilePart=0x0) returned 0x35 [0181.015] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0181.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0181.016] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0181.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0181.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0181.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24", lpFilePart=0x0) returned 0x34 [0181.016] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\", lpFilePart=0x0) returned 0x35 [0181.016] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0181.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0181.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0181.017] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0181.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0181.017] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", lpFilePart=0x0) returned 0x4a [0181.017] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", dwFileAttributes=0x80) returned 1 [0181.018] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4.Horsuke", lpFilePart=0x0) returned 0x52 [0181.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0181.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\mrklash6barh8zbk6.mp4.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0181.019] GetFileType (hFile=0x15c) returned 0x1 [0181.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0181.019] GetFileType (hFile=0x15c) returned 0x1 [0181.526] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", lpFilePart=0x0) returned 0x4a [0181.526] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0181.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\mrklash6barh8zbk6.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0181.527] GetFileType (hFile=0x23c) returned 0x1 [0181.527] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0181.527] GetFileType (hFile=0x23c) returned 0x1 [0181.527] ReadFile (in: hFile=0x23c, lpBuffer=0x239b0f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239b0f8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0181.532] ReadFile (in: hFile=0x23c, lpBuffer=0x239b0f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239b0f8*, lpNumberOfBytesRead=0x2edee8*=0x24, lpOverlapped=0x0) returned 1 [0181.532] ReadFile (in: hFile=0x23c, lpBuffer=0x239b0f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239b0f8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0181.532] CloseHandle (hObject=0x23c) returned 1 [0181.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4", lpFilePart=0x0) returned 0x4a [0181.533] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\mrklAsH6barH8zbK6.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\mrklash6barh8zbk6.mp4")) returned 1 [0181.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0181.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64", lpFilePart=0x0) returned 0x46 [0181.533] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\", lpFilePart=0x0) returned 0x47 [0181.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0181.534] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0181.534] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0181.534] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0181.534] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0181.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0181.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0181.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64", lpFilePart=0x0) returned 0x46 [0181.534] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\", lpFilePart=0x0) returned 0x47 [0181.534] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0181.535] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0181.535] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0181.535] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0181.535] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0181.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0181.535] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0181.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi", lpFilePart=0x0) returned 0x59 [0181.535] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\", lpFilePart=0x0) returned 0x5a [0181.535] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0181.535] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0181.536] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0181.536] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0181.536] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0181.536] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0181.536] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0181.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi", lpFilePart=0x0) returned 0x59 [0181.536] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\", lpFilePart=0x0) returned 0x5a [0181.536] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0181.536] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0181.536] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0181.537] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0181.537] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0181.537] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0181.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0181.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx", lpFilePart=0x0) returned 0x5e [0181.537] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\", lpFilePart=0x0) returned 0x5f [0181.537] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0181.537] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.537] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.537] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.538] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0181.539] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0181.539] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0181.539] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0181.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx", lpFilePart=0x0) returned 0x5e [0181.539] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\", lpFilePart=0x0) returned 0x5f [0181.539] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0181.539] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.539] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0181.540] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0181.540] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0181.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0181.540] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0181.540] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", lpFilePart=0x0) returned 0x75 [0181.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", dwFileAttributes=0x80) returned 1 [0181.541] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi.Horsuke", lpFilePart=0x0) returned 0x7d [0181.541] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0181.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\lx9scyk4n9phbagodk.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0181.542] GetFileType (hFile=0x15c) returned 0x1 [0181.542] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0181.542] GetFileType (hFile=0x15c) returned 0x1 [0182.076] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", lpFilePart=0x0) returned 0x75 [0182.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0182.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\lx9scyk4n9phbagodk.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0182.077] GetFileType (hFile=0x23c) returned 0x1 [0182.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0182.077] GetFileType (hFile=0x23c) returned 0x1 [0182.077] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.081] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.083] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.083] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.083] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.083] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.084] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.085] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.086] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.086] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0xc4e, lpOverlapped=0x0) returned 1 [0182.086] ReadFile (in: hFile=0x23c, lpBuffer=0x228fece, nNumberOfBytesToRead=0x3b2, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x228fece*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0182.086] ReadFile (in: hFile=0x23c, lpBuffer=0x2290298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2290298*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0182.086] CloseHandle (hObject=0x23c) returned 1 [0182.086] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi", lpFilePart=0x0) returned 0x75 [0182.086] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\lX9ScYk4N9phBAgoDK.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\lx9scyk4n9phbagodk.avi")) returned 1 [0182.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", lpFilePart=0x0) returned 0x68 [0182.088] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", dwFileAttributes=0x80) returned 1 [0182.088] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv.Horsuke", lpFilePart=0x0) returned 0x70 [0182.089] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0182.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\qe1xc.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0182.089] GetFileType (hFile=0x15c) returned 0x1 [0182.089] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0182.089] GetFileType (hFile=0x15c) returned 0x1 [0182.587] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", lpFilePart=0x0) returned 0x68 [0182.588] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0182.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\qe1xc.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0182.588] GetFileType (hFile=0x23c) returned 0x1 [0182.588] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0182.588] GetFileType (hFile=0x23c) returned 0x1 [0182.588] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.593] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.593] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.594] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.594] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.594] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.594] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.595] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.595] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.595] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.595] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.596] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.596] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.596] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.596] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.596] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0182.597] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x16d, lpOverlapped=0x0) returned 1 [0182.597] ReadFile (in: hFile=0x23c, lpBuffer=0x23890b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x23890b8*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0182.597] CloseHandle (hObject=0x23c) returned 1 [0182.597] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv", lpFilePart=0x0) returned 0x68 [0182.597] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Qe1XC.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\qe1xc.flv")) returned 1 [0182.599] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", lpFilePart=0x0) returned 0x77 [0182.599] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", dwFileAttributes=0x80) returned 1 [0182.600] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv.Horsuke", lpFilePart=0x0) returned 0x7f [0182.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0182.600] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\rmkhof-rmhmi5dyhwxrw.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0182.601] GetFileType (hFile=0x15c) returned 0x1 [0182.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0182.601] GetFileType (hFile=0x15c) returned 0x1 [0183.094] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", lpFilePart=0x0) returned 0x77 [0183.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0183.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\rmkhof-rmhmi5dyhwxrw.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0183.095] GetFileType (hFile=0x23c) returned 0x1 [0183.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0183.095] GetFileType (hFile=0x23c) returned 0x1 [0183.095] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.099] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.101] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.102] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.102] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.102] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.102] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.102] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.103] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.103] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.103] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.103] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.103] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0183.104] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x81a, lpOverlapped=0x0) returned 1 [0183.104] ReadFile (in: hFile=0x23c, lpBuffer=0x225f13a, nNumberOfBytesToRead=0x3e6, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f13a*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0183.104] ReadFile (in: hFile=0x23c, lpBuffer=0x225f538, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x225f538*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0183.104] CloseHandle (hObject=0x23c) returned 1 [0183.104] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv", lpFilePart=0x0) returned 0x77 [0183.104] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\RmkhOF-rmHmI5DYHWXrw.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\rmkhof-rmhmi5dyhwxrw.flv")) returned 1 [0183.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0183.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp", lpFilePart=0x0) returned 0x72 [0183.106] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\", lpFilePart=0x0) returned 0x73 [0183.106] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0183.106] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.106] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.106] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.106] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.106] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.106] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.107] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0183.107] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0183.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0183.107] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0183.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0183.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp", lpFilePart=0x0) returned 0x72 [0183.107] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\", lpFilePart=0x0) returned 0x73 [0183.107] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0183.107] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.107] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.107] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.108] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.108] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.108] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0183.108] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0183.108] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0183.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0183.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0183.108] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", lpFilePart=0x0) returned 0x8a [0183.108] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", dwFileAttributes=0x80) returned 1 [0183.109] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi.Horsuke", lpFilePart=0x0) returned 0x92 [0183.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0183.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\39auwqgkawwmkzw5ehv.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0183.110] GetFileType (hFile=0x15c) returned 0x1 [0183.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0183.110] GetFileType (hFile=0x15c) returned 0x1 [0183.601] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", lpFilePart=0x0) returned 0x8a [0183.601] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0183.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\39auwqgkawwmkzw5ehv.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0183.602] GetFileType (hFile=0x23c) returned 0x1 [0183.602] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0183.602] GetFileType (hFile=0x23c) returned 0x1 [0183.602] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.607] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.607] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.607] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.607] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.608] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.608] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0183.608] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0xad2, lpOverlapped=0x0) returned 1 [0183.608] ReadFile (in: hFile=0x23c, lpBuffer=0x235b302, nNumberOfBytesToRead=0x12e, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b302*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0183.608] ReadFile (in: hFile=0x23c, lpBuffer=0x235b448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235b448*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0183.608] CloseHandle (hObject=0x23c) returned 1 [0183.608] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi", lpFilePart=0x0) returned 0x8a [0183.608] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\39auWqGKAwwmkzW5EHv.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\39auwqgkawwmkzw5ehv.avi")) returned 1 [0183.609] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", lpFilePart=0x0) returned 0x88 [0183.609] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", dwFileAttributes=0x80) returned 1 [0183.610] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv.Horsuke", lpFilePart=0x0) returned 0x90 [0183.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0183.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\bwajlmspid0e6hkms.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0183.611] GetFileType (hFile=0x15c) returned 0x1 [0183.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0183.611] GetFileType (hFile=0x15c) returned 0x1 [0184.100] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", lpFilePart=0x0) returned 0x88 [0184.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0184.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\bwajlmspid0e6hkms.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0184.102] GetFileType (hFile=0x23c) returned 0x1 [0184.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0184.102] GetFileType (hFile=0x23c) returned 0x1 [0184.102] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.105] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.107] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.107] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.107] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.108] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.108] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.108] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.108] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.109] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.109] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.117] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.117] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.118] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0xa4e, lpOverlapped=0x0) returned 1 [0184.118] ReadFile (in: hFile=0x23c, lpBuffer=0x224bcee, nNumberOfBytesToRead=0x1b2, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224bcee*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0184.118] ReadFile (in: hFile=0x23c, lpBuffer=0x224beb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224beb8*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0184.118] CloseHandle (hObject=0x23c) returned 1 [0184.118] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv", lpFilePart=0x0) returned 0x88 [0184.118] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\bWAjlmSpiD0e6HkmS.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\bwajlmspid0e6hkms.flv")) returned 1 [0184.120] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", lpFilePart=0x0) returned 0x7b [0184.121] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", dwFileAttributes=0x80) returned 1 [0184.122] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi.Horsuke", lpFilePart=0x0) returned 0x83 [0184.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0184.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\h3k-.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0184.123] GetFileType (hFile=0x15c) returned 0x1 [0184.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0184.123] GetFileType (hFile=0x15c) returned 0x1 [0184.654] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", lpFilePart=0x0) returned 0x7b [0184.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0184.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\h3k-.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0184.655] GetFileType (hFile=0x23c) returned 0x1 [0184.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0184.655] GetFileType (hFile=0x23c) returned 0x1 [0184.655] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.660] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.661] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.661] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.661] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.661] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.661] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.662] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.662] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.662] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.662] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.663] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0184.663] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0xf7, lpOverlapped=0x0) returned 1 [0184.663] ReadFile (in: hFile=0x23c, lpBuffer=0x2342918, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x2342918*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0184.663] CloseHandle (hObject=0x23c) returned 1 [0184.663] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi", lpFilePart=0x0) returned 0x7b [0184.663] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\h3K-.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\h3k-.avi")) returned 1 [0184.666] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.TXT", lpFilePart=0x0) returned 0x7b [0184.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0184.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0184.667] GetFileType (hFile=0x15c) returned 0x1 [0184.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0184.667] GetFileType (hFile=0x15c) returned 0x1 [0184.668] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.png", lpFilePart=0x0) returned 0x7b [0184.668] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0184.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0184.669] GetFileType (hFile=0x15c) returned 0x1 [0184.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0184.669] GetFileType (hFile=0x15c) returned 0x1 [0184.669] WriteFile (in: hFile=0x15c, lpBuffer=0x235a528*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x235a528*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0184.670] CloseHandle (hObject=0x15c) returned 1 [0184.670] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.vbs", lpFilePart=0x0) returned 0x7b [0184.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0184.670] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0184.671] GetFileType (hFile=0x15c) returned 0x1 [0184.671] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0184.671] GetFileType (hFile=0x15c) returned 0x1 [0184.671] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa7 [0184.671] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0184.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\fFmnPWYM5Ivhh4zl6yp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\ffmnpwym5ivhh4zl6yp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0184.672] GetFileType (hFile=0x15c) returned 0x1 [0184.672] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0184.672] GetFileType (hFile=0x15c) returned 0x1 [0184.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0184.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r", lpFilePart=0x0) returned 0x67 [0184.682] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\", lpFilePart=0x0) returned 0x68 [0184.682] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0184.682] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.682] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.682] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.683] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.683] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.683] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.683] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0184.683] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0184.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0184.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0184.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0184.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r", lpFilePart=0x0) returned 0x67 [0184.683] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\", lpFilePart=0x0) returned 0x68 [0184.683] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0184.683] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0184.684] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0184.684] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0184.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0184.684] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0184.684] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", lpFilePart=0x0) returned 0x75 [0184.684] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", dwFileAttributes=0x80) returned 1 [0184.685] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4.Horsuke", lpFilePart=0x0) returned 0x7d [0184.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0184.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\fh27mvfcy.mp4.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0184.686] GetFileType (hFile=0x15c) returned 0x1 [0184.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0184.686] GetFileType (hFile=0x15c) returned 0x1 [0185.263] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", lpFilePart=0x0) returned 0x75 [0185.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0185.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\fh27mvfcy.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0185.264] GetFileType (hFile=0x23c) returned 0x1 [0185.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0185.264] GetFileType (hFile=0x23c) returned 0x1 [0185.264] ReadFile (in: hFile=0x23c, lpBuffer=0x224e7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224e7d0*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0185.268] ReadFile (in: hFile=0x23c, lpBuffer=0x224e7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224e7d0*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0185.269] ReadFile (in: hFile=0x23c, lpBuffer=0x224e7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224e7d0*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0185.269] ReadFile (in: hFile=0x23c, lpBuffer=0x224e7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224e7d0*, lpNumberOfBytesRead=0x2edce8*=0xb69, lpOverlapped=0x0) returned 1 [0185.269] ReadFile (in: hFile=0x23c, lpBuffer=0x224e721, nNumberOfBytesToRead=0x97, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224e721*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0185.270] ReadFile (in: hFile=0x23c, lpBuffer=0x224e7d0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224e7d0*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0185.270] CloseHandle (hObject=0x23c) returned 1 [0185.270] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4", lpFilePart=0x0) returned 0x75 [0185.270] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\fH27mVFCy.mp4" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\fh27mvfcy.mp4")) returned 1 [0185.271] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", lpFilePart=0x0) returned 0x73 [0185.271] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", dwFileAttributes=0x80) returned 1 [0185.272] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi.Horsuke", lpFilePart=0x0) returned 0x7b [0185.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0185.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\tjg4piq.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0185.272] GetFileType (hFile=0x15c) returned 0x1 [0185.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0185.272] GetFileType (hFile=0x15c) returned 0x1 [0186.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", lpFilePart=0x0) returned 0x73 [0186.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0186.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\tjg4piq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0186.006] GetFileType (hFile=0x23c) returned 0x1 [0186.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0186.006] GetFileType (hFile=0x23c) returned 0x1 [0186.006] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.011] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.011] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.012] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.012] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.012] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.013] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.018] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.018] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.019] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.019] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.019] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.020] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.020] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.020] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.021] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.021] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.021] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.022] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.022] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.022] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.022] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.023] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.023] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.023] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0xf8f, lpOverlapped=0x0) returned 1 [0186.024] ReadFile (in: hFile=0x23c, lpBuffer=0x233aecf, nNumberOfBytesToRead=0x71, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233aecf*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0186.024] ReadFile (in: hFile=0x23c, lpBuffer=0x233af58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x233af58*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0186.024] CloseHandle (hObject=0x23c) returned 1 [0186.024] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi", lpFilePart=0x0) returned 0x73 [0186.024] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\TJg4piQ.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\tjg4piq.avi")) returned 1 [0186.026] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", lpFilePart=0x0) returned 0x80 [0186.026] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", dwFileAttributes=0x80) returned 1 [0186.027] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi.Horsuke", lpFilePart=0x0) returned 0x88 [0186.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0186.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\zdyxuwlht050 9lozvqm.avi.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0186.028] GetFileType (hFile=0x15c) returned 0x1 [0186.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0186.028] GetFileType (hFile=0x15c) returned 0x1 [0186.806] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", lpFilePart=0x0) returned 0x80 [0186.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0186.806] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\zdyxuwlht050 9lozvqm.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0186.807] GetFileType (hFile=0x23c) returned 0x1 [0186.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0186.807] GetFileType (hFile=0x23c) returned 0x1 [0186.807] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.839] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.839] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.839] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.840] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.840] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.840] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.840] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.841] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.841] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0186.841] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0xf4c, lpOverlapped=0x0) returned 1 [0186.841] ReadFile (in: hFile=0x23c, lpBuffer=0x223d37c, nNumberOfBytesToRead=0xb4, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d37c*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0186.841] ReadFile (in: hFile=0x23c, lpBuffer=0x223d448, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x223d448*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0186.841] CloseHandle (hObject=0x23c) returned 1 [0186.842] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi", lpFilePart=0x0) returned 0x80 [0186.842] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\zdYXUwLHT050 9loZvQM.avi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\zdyxuwlht050 9lozvqm.avi")) returned 1 [0186.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0186.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t", lpFilePart=0x0) returned 0x75 [0186.843] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\", lpFilePart=0x0) returned 0x76 [0186.843] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0186.843] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0186.843] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0186.843] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0186.844] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0186.844] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0186.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0186.844] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0186.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0186.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t", nBufferLength=0x105, lpBuffer=0x2ed780, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t", lpFilePart=0x0) returned 0x75 [0186.844] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\", nBufferLength=0x105, lpBuffer=0x2ed720, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\", lpFilePart=0x0) returned 0x76 [0186.844] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\*", lpFindFileData=0x2ed930 | out: lpFindFileData=0x2ed930) returned 0x4cf960 [0186.844] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0186.844] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0186.844] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 1 [0186.845] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2ed980 | out: lpFindFileData=0x2ed980) returned 0 [0186.845] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0186.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbe0) returned 1 [0186.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0186.847] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.TXT", lpFilePart=0x0) returned 0x7e [0186.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0186.852] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\2fjey79jm1u3t\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0186.876] GetFileType (hFile=0x15c) returned 0x1 [0186.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0186.876] GetFileType (hFile=0x15c) returned 0x1 [0186.877] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed6b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.png", lpFilePart=0x0) returned 0x7e [0186.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb90) returned 1 [0186.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\2fjey79jm1u3t\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0186.879] GetFileType (hFile=0x15c) returned 0x1 [0186.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb00) returned 1 [0186.879] GetFileType (hFile=0x15c) returned 0x1 [0186.879] WriteFile (in: hFile=0x15c, lpBuffer=0x22575f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edcb8, lpOverlapped=0x0 | out: lpBuffer=0x22575f0*, lpNumberOfBytesWritten=0x2edcb8*=0x2337, lpOverlapped=0x0) returned 1 [0186.880] CloseHandle (hObject=0x15c) returned 1 [0186.880] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.vbs", lpFilePart=0x0) returned 0x7e [0186.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0186.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\2fjey79jm1u3t\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0186.881] GetFileType (hFile=0x15c) returned 0x1 [0186.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0186.881] GetFileType (hFile=0x15c) returned 0x1 [0186.882] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed5f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xaa [0186.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edad0) returned 1 [0186.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\2FjEy79jm1U3t\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\2fjey79jm1u3t\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0186.882] GetFileType (hFile=0x15c) returned 0x1 [0186.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eda40) returned 1 [0186.883] GetFileType (hFile=0x15c) returned 0x1 [0186.883] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.TXT", lpFilePart=0x0) returned 0x70 [0186.883] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0186.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0186.884] GetFileType (hFile=0x15c) returned 0x1 [0186.884] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0186.884] GetFileType (hFile=0x15c) returned 0x1 [0186.885] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.png", lpFilePart=0x0) returned 0x70 [0186.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0186.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0186.886] GetFileType (hFile=0x15c) returned 0x1 [0186.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0186.886] GetFileType (hFile=0x15c) returned 0x1 [0186.886] WriteFile (in: hFile=0x15c, lpBuffer=0x22692c8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x22692c8*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0186.887] CloseHandle (hObject=0x15c) returned 1 [0186.887] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.vbs", lpFilePart=0x0) returned 0x70 [0186.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0186.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0186.888] GetFileType (hFile=0x15c) returned 0x1 [0186.888] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0186.888] GetFileType (hFile=0x15c) returned 0x1 [0186.889] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x9c [0186.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0186.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\P-sQCS8r\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\p-sqcs8r\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0186.890] GetFileType (hFile=0x15c) returned 0x1 [0186.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0186.890] GetFileType (hFile=0x15c) returned 0x1 [0186.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0186.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ", lpFilePart=0x0) returned 0x70 [0186.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\", lpFilePart=0x0) returned 0x71 [0186.892] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0186.892] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0186.903] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0186.903] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0186.903] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0186.903] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0186.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0186.903] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0186.903] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0186.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ", nBufferLength=0x105, lpBuffer=0x2ed800, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ", lpFilePart=0x0) returned 0x70 [0186.903] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\", nBufferLength=0x105, lpBuffer=0x2ed7a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\", lpFilePart=0x0) returned 0x71 [0186.903] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\*", lpFindFileData=0x2ed9b0 | out: lpFindFileData=0x2ed9b0) returned 0x4cf960 [0186.903] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0186.904] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0186.904] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 1 [0186.904] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda00 | out: lpFindFileData=0x2eda00) returned 0 [0186.904] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0186.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc60) returned 1 [0186.904] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0186.904] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", lpFilePart=0x0) returned 0x86 [0186.904] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", dwFileAttributes=0x80) returned 1 [0186.905] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv.Horsuke", lpFilePart=0x0) returned 0x8e [0186.905] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0186.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\1kr_lmbaf c8 dedv.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0186.966] GetFileType (hFile=0x15c) returned 0x1 [0186.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0186.966] GetFileType (hFile=0x15c) returned 0x1 [0187.855] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", lpFilePart=0x0) returned 0x86 [0187.855] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0187.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\1kr_lmbaf c8 dedv.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0187.856] GetFileType (hFile=0x23c) returned 0x1 [0187.856] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0187.856] GetFileType (hFile=0x23c) returned 0x1 [0187.856] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0187.861] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0187.861] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0187.861] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0187.862] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0187.862] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0187.862] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x22d, lpOverlapped=0x0) returned 1 [0187.862] ReadFile (in: hFile=0x23c, lpBuffer=0x235c3e8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x235c3e8*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0187.862] CloseHandle (hObject=0x23c) returned 1 [0187.863] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv", lpFilePart=0x0) returned 0x86 [0187.863] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\1kr_LmbAF C8 dedV.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\1kr_lmbaf c8 dedv.flv")) returned 1 [0187.906] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", lpFilePart=0x0) returned 0x82 [0187.906] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", dwFileAttributes=0x80) returned 1 [0187.907] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv.Horsuke", lpFilePart=0x0) returned 0x8a [0187.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0187.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv.Horsuke" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\53sju6jpyw9w4.flv.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0187.908] GetFileType (hFile=0x15c) returned 0x1 [0187.908] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0187.908] GetFileType (hFile=0x15c) returned 0x1 [0188.748] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", nBufferLength=0x105, lpBuffer=0x2ed6d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", lpFilePart=0x0) returned 0x82 [0188.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbb0) returned 1 [0188.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\53sju6jpyw9w4.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0188.749] GetFileType (hFile=0x23c) returned 0x1 [0188.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb20) returned 1 [0188.750] GetFileType (hFile=0x23c) returned 0x1 [0188.835] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.841] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.841] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.841] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.842] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.842] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.842] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.842] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.843] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.843] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.843] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.843] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.843] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.844] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.844] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x1000, lpOverlapped=0x0) returned 1 [0188.844] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x677, lpOverlapped=0x0) returned 1 [0188.844] ReadFile (in: hFile=0x23c, lpBuffer=0x224b2c7, nNumberOfBytesToRead=0x189, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b2c7*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0188.844] ReadFile (in: hFile=0x23c, lpBuffer=0x224b468, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edce8, lpOverlapped=0x0 | out: lpBuffer=0x224b468*, lpNumberOfBytesRead=0x2edce8*=0x0, lpOverlapped=0x0) returned 1 [0188.844] CloseHandle (hObject=0x23c) returned 1 [0188.845] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", nBufferLength=0x105, lpBuffer=0x2ed7e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv", lpFilePart=0x0) returned 0x82 [0188.845] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\53SjU6JPYW9w4.flv" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\53sju6jpyw9w4.flv")) returned 1 [0188.848] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.TXT", lpFilePart=0x0) returned 0x79 [0188.848] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0188.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.849] GetFileType (hFile=0x15c) returned 0x1 [0188.849] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0188.849] GetFileType (hFile=0x15c) returned 0x1 [0188.850] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed730, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.png", lpFilePart=0x0) returned 0x79 [0188.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc10) returned 1 [0188.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0188.851] GetFileType (hFile=0x15c) returned 0x1 [0188.851] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb80) returned 1 [0188.851] GetFileType (hFile=0x15c) returned 0x1 [0188.851] WriteFile (in: hFile=0x15c, lpBuffer=0x2266740*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edd38, lpOverlapped=0x0 | out: lpBuffer=0x2266740*, lpNumberOfBytesWritten=0x2edd38*=0x2337, lpOverlapped=0x0) returned 1 [0188.852] CloseHandle (hObject=0x15c) returned 1 [0188.852] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.vbs", lpFilePart=0x0) returned 0x79 [0188.888] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0188.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.889] GetFileType (hFile=0x15c) returned 0x1 [0188.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0188.889] GetFileType (hFile=0x15c) returned 0x1 [0188.890] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed670, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa5 [0188.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edb50) returned 1 [0188.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\xA08YOOH9OgtIx9zZ\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\xa08yooh9ogtix9zz\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.891] GetFileType (hFile=0x15c) returned 0x1 [0188.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edac0) returned 1 [0188.891] GetFileType (hFile=0x15c) returned 0x1 [0188.892] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.TXT", lpFilePart=0x0) returned 0x67 [0188.892] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0188.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.893] GetFileType (hFile=0x15c) returned 0x1 [0188.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0188.893] GetFileType (hFile=0x15c) returned 0x1 [0188.893] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.png", lpFilePart=0x0) returned 0x67 [0188.894] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0188.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0188.894] GetFileType (hFile=0x15c) returned 0x1 [0188.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0188.894] GetFileType (hFile=0x15c) returned 0x1 [0188.894] WriteFile (in: hFile=0x15c, lpBuffer=0x22783a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x22783a8*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0188.895] CloseHandle (hObject=0x15c) returned 1 [0188.895] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.vbs", lpFilePart=0x0) returned 0x67 [0188.895] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0188.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.896] GetFileType (hFile=0x15c) returned 0x1 [0188.896] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0188.896] GetFileType (hFile=0x15c) returned 0x1 [0188.897] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x93 [0188.897] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0188.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\qBIx\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\qbix\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.897] GetFileType (hFile=0x15c) returned 0x1 [0188.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0188.897] GetFileType (hFile=0x15c) returned 0x1 [0188.898] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.TXT", lpFilePart=0x0) returned 0x62 [0188.898] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0188.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.898] GetFileType (hFile=0x15c) returned 0x1 [0188.898] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0188.899] GetFileType (hFile=0x15c) returned 0x1 [0188.899] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.png", lpFilePart=0x0) returned 0x62 [0188.899] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0188.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0188.900] GetFileType (hFile=0x15c) returned 0x1 [0188.900] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0188.900] GetFileType (hFile=0x15c) returned 0x1 [0188.900] WriteFile (in: hFile=0x15c, lpBuffer=0x2289f30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2289f30*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0188.901] CloseHandle (hObject=0x15c) returned 1 [0188.901] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.vbs", lpFilePart=0x0) returned 0x62 [0188.901] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0188.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.901] GetFileType (hFile=0x15c) returned 0x1 [0188.901] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0188.902] GetFileType (hFile=0x15c) returned 0x1 [0188.902] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8e [0188.902] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0188.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\kTzDYi3Pn7T7HpNQhi\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\ktzdyi3pn7t7hpnqhi\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.940] GetFileType (hFile=0x15c) returned 0x1 [0188.940] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0188.940] GetFileType (hFile=0x15c) returned 0x1 [0188.941] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.TXT", lpFilePart=0x0) returned 0x4f [0188.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0188.941] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.941] GetFileType (hFile=0x15c) returned 0x1 [0188.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0188.941] GetFileType (hFile=0x15c) returned 0x1 [0188.942] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.png", lpFilePart=0x0) returned 0x4f [0188.942] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0188.942] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0188.943] GetFileType (hFile=0x15c) returned 0x1 [0188.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0188.943] GetFileType (hFile=0x15c) returned 0x1 [0188.943] WriteFile (in: hFile=0x15c, lpBuffer=0x229ba18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x229ba18*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0188.944] CloseHandle (hObject=0x15c) returned 1 [0188.944] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.vbs", lpFilePart=0x0) returned 0x4f [0188.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0188.944] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.954] GetFileType (hFile=0x15c) returned 0x1 [0188.954] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0188.954] GetFileType (hFile=0x15c) returned 0x1 [0188.955] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7b [0188.955] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0188.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\6x1vn6fzy5RsJrd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\6x1vn6fzy5rsjrd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.993] GetFileType (hFile=0x15c) returned 0x1 [0188.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0188.993] GetFileType (hFile=0x15c) returned 0x1 [0188.994] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.TXT", lpFilePart=0x0) returned 0x3d [0188.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0188.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.995] GetFileType (hFile=0x15c) returned 0x1 [0188.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0188.995] GetFileType (hFile=0x15c) returned 0x1 [0188.996] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.png", lpFilePart=0x0) returned 0x3d [0188.996] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0188.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0188.996] GetFileType (hFile=0x15c) returned 0x1 [0188.996] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0188.996] GetFileType (hFile=0x15c) returned 0x1 [0188.996] WriteFile (in: hFile=0x15c, lpBuffer=0x22ad3d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22ad3d8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0188.997] CloseHandle (hObject=0x15c) returned 1 [0188.997] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.vbs", lpFilePart=0x0) returned 0x3d [0188.997] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0188.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0188.998] GetFileType (hFile=0x15c) returned 0x1 [0188.998] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0188.998] GetFileType (hFile=0x15c) returned 0x1 [0188.999] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x69 [0188.999] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0188.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\SiKH1 GEFTT2S24\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\sikh1 geftt2s24\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.000] GetFileType (hFile=0x15c) returned 0x1 [0189.000] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0189.000] GetFileType (hFile=0x15c) returned 0x1 [0189.001] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0189.001] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0189.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.001] GetFileType (hFile=0x15c) returned 0x1 [0189.001] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0189.002] GetFileType (hFile=0x15c) returned 0x1 [0189.002] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png", lpFilePart=0x0) returned 0x2d [0189.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0189.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0189.003] GetFileType (hFile=0x15c) returned 0x1 [0189.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0189.003] GetFileType (hFile=0x15c) returned 0x1 [0189.003] WriteFile (in: hFile=0x15c, lpBuffer=0x22bec98*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22bec98*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0189.004] CloseHandle (hObject=0x15c) returned 1 [0189.004] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0189.004] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0189.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.004] GetFileType (hFile=0x15c) returned 0x1 [0189.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0189.004] GetFileType (hFile=0x15c) returned 0x1 [0189.005] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0189.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0189.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Videos\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\videos\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.005] GetFileType (hFile=0x15c) returned 0x1 [0189.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0189.005] GetFileType (hFile=0x15c) returned 0x1 [0189.006] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.TXT", lpFilePart=0x0) returned 0x26 [0189.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0189.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.TXT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.007] GetFileType (hFile=0x15c) returned 0x1 [0189.007] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0189.007] GetFileType (hFile=0x15c) returned 0x1 [0189.007] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.png", lpFilePart=0x0) returned 0x26 [0189.008] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0189.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0189.009] GetFileType (hFile=0x15c) returned 0x1 [0189.009] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede80) returned 1 [0189.009] GetFileType (hFile=0x15c) returned 0x1 [0189.009] WriteFile (in: hFile=0x15c, lpBuffer=0x22d0488*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ee038, lpOverlapped=0x0 | out: lpBuffer=0x22d0488*, lpNumberOfBytesWritten=0x2ee038*=0x2337, lpOverlapped=0x0) returned 1 [0189.010] CloseHandle (hObject=0x15c) returned 1 [0189.010] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.vbs", lpFilePart=0x0) returned 0x26 [0189.010] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0189.010] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Hack.vbs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.011] GetFileType (hFile=0x15c) returned 0x1 [0189.011] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0189.011] GetFileType (hFile=0x15c) returned 0x1 [0189.012] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed970, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x52 [0189.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede50) returned 1 [0189.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0189.012] GetFileType (hFile=0x15c) returned 0x1 [0189.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2eddc0) returned 1 [0189.013] GetFileType (hFile=0x15c) returned 0x1 [0189.013] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0189.013] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0189.013] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13 [0189.014] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf960 [0189.014] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.014] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.015] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.016] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0189.016] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0189.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0189.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0189.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ee010) returned 1 [0189.016] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users", nBufferLength=0x105, lpBuffer=0x2edb00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users", lpFilePart=0x0) returned 0x12 [0189.016] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\", nBufferLength=0x105, lpBuffer=0x2edaa0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\", lpFilePart=0x0) returned 0x13 [0189.016] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\*", lpFindFileData=0x2edcb0 | out: lpFindFileData=0x2edcb0) returned 0x4cf960 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.017] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.018] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 1 [0189.019] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edd00 | out: lpFindFileData=0x2edd00) returned 0 [0189.019] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0189.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf60) returned 1 [0189.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edf20) returned 1 [0189.019] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edbb0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.png", lpFilePart=0x0) returned 0x1b [0189.019] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Hack.png", dwFileAttributes=0x80) returned 1 [0189.020] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x23 [0189.020] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edeb0) returned 1 [0189.020] CreateFileW (lpFileName="C:\\Users\\All Users\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0189.021] GetFileType (hFile=0x15c) returned 0x1 [0189.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0189.021] GetFileType (hFile=0x15c) returned 0x1 [0189.948] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.png", lpFilePart=0x0) returned 0x1b [0189.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edeb0) returned 1 [0189.948] CreateFileW (lpFileName="C:\\Users\\All Users\\Hack.png" (normalized: "c:\\users\\all users\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0189.949] GetFileType (hFile=0x23c) returned 0x1 [0189.949] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0189.949] GetFileType (hFile=0x23c) returned 0x1 [0189.949] ReadFile (in: hFile=0x23c, lpBuffer=0x23c41e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edfe8, lpOverlapped=0x0 | out: lpBuffer=0x23c41e0*, lpNumberOfBytesRead=0x2edfe8*=0x1000, lpOverlapped=0x0) returned 1 [0189.954] ReadFile (in: hFile=0x23c, lpBuffer=0x23c41e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edfe8, lpOverlapped=0x0 | out: lpBuffer=0x23c41e0*, lpNumberOfBytesRead=0x2edfe8*=0x1000, lpOverlapped=0x0) returned 1 [0189.954] ReadFile (in: hFile=0x23c, lpBuffer=0x23c41e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edfe8, lpOverlapped=0x0 | out: lpBuffer=0x23c41e0*, lpNumberOfBytesRead=0x2edfe8*=0x337, lpOverlapped=0x0) returned 1 [0189.954] ReadFile (in: hFile=0x23c, lpBuffer=0x23c41e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edfe8, lpOverlapped=0x0 | out: lpBuffer=0x23c41e0*, lpNumberOfBytesRead=0x2edfe8*=0x0, lpOverlapped=0x0) returned 1 [0189.954] CloseHandle (hObject=0x23c) returned 1 [0189.954] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edae0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Hack.png", lpFilePart=0x0) returned 0x1b [0189.954] DeleteFileW (lpFileName="C:\\Users\\All Users\\Hack.png" (normalized: "c:\\users\\all users\\hack.png")) returned 1 [0189.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0189.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0189.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19 [0189.956] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0189.956] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.956] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.957] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0189.957] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0189.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0189.957] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0189.957] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0189.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe", lpFilePart=0x0) returned 0x18 [0189.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\", lpFilePart=0x0) returned 0x19 [0189.957] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0189.958] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0189.959] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0189.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0189.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0189.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x21 [0189.959] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png", dwFileAttributes=0x80) returned 1 [0189.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x29 [0189.993] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0189.993] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0189.994] GetFileType (hFile=0x15c) returned 0x1 [0189.994] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0189.994] GetFileType (hFile=0x15c) returned 0x1 [0191.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x21 [0191.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0191.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0191.062] GetFileType (hFile=0x23c) returned 0x1 [0191.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0191.062] GetFileType (hFile=0x23c) returned 0x1 [0191.062] ReadFile (in: hFile=0x23c, lpBuffer=0x22b2158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b2158*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0191.067] ReadFile (in: hFile=0x23c, lpBuffer=0x22b2158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b2158*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0191.068] ReadFile (in: hFile=0x23c, lpBuffer=0x22b2158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b2158*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0191.068] ReadFile (in: hFile=0x23c, lpBuffer=0x22b2158, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22b2158*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0191.068] CloseHandle (hObject=0x23c) returned 1 [0191.068] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x21 [0191.068] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\hack.png")) returned 1 [0191.069] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0191.069] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20 [0191.069] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21 [0191.069] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.070] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0191.070] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0191.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0191.070] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0191.070] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0191.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat", lpFilePart=0x0) returned 0x20 [0191.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\", lpFilePart=0x0) returned 0x21 [0191.071] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0191.071] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.071] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0191.072] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0191.072] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0191.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0191.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0191.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x29 [0191.072] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", dwFileAttributes=0x80) returned 1 [0191.073] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x31 [0191.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0191.073] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0191.073] GetFileType (hFile=0x15c) returned 0x1 [0191.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0191.073] GetFileType (hFile=0x15c) returned 0x1 [0191.935] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x29 [0191.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0191.935] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0191.935] GetFileType (hFile=0x23c) returned 0x1 [0191.935] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0191.935] GetFileType (hFile=0x23c) returned 0x1 [0191.935] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a0110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0191.940] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a0110*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0191.940] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a0110*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0191.941] ReadFile (in: hFile=0x23c, lpBuffer=0x23a0110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a0110*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0191.941] CloseHandle (hObject=0x23c) returned 1 [0191.979] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x29 [0191.979] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.png")) returned 1 [0191.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0191.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25 [0191.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26 [0191.981] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0191.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.981] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0191.982] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0191.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0191.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0191.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0191.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0", lpFilePart=0x0) returned 0x25 [0191.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\", lpFilePart=0x0) returned 0x26 [0191.982] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0191.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.982] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0191.983] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0191.983] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0191.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0191.983] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0191.983] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0191.983] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", dwFileAttributes=0x80) returned 1 [0191.984] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x36 [0191.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0191.984] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0191.984] GetFileType (hFile=0x15c) returned 0x1 [0191.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0191.985] GetFileType (hFile=0x15c) returned 0x1 [0192.940] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0192.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0192.940] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0192.941] GetFileType (hFile=0x23c) returned 0x1 [0192.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0192.941] GetFileType (hFile=0x23c) returned 0x1 [0192.941] ReadFile (in: hFile=0x23c, lpBuffer=0x228e3f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228e3f0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0192.947] ReadFile (in: hFile=0x23c, lpBuffer=0x228e3f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228e3f0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0192.948] ReadFile (in: hFile=0x23c, lpBuffer=0x228e3f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228e3f0*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0192.948] ReadFile (in: hFile=0x23c, lpBuffer=0x228e3f0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228e3f0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0192.948] CloseHandle (hObject=0x23c) returned 1 [0192.948] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0192.948] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.png")) returned 1 [0192.950] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0192.950] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f [0192.950] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30 [0192.950] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.951] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0192.952] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0192.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0192.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0192.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0192.952] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate", lpFilePart=0x0) returned 0x2f [0192.952] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\", lpFilePart=0x0) returned 0x30 [0192.952] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0192.952] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.952] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.952] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.953] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.953] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.953] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0192.953] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0192.953] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0192.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0192.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0192.953] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", lpFilePart=0x0) returned 0x38 [0192.953] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", dwFileAttributes=0x80) returned 1 [0192.955] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x40 [0192.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0192.956] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0192.956] GetFileType (hFile=0x15c) returned 0x1 [0192.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0192.956] GetFileType (hFile=0x15c) returned 0x1 [0194.170] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", lpFilePart=0x0) returned 0x38 [0194.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0194.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0194.171] GetFileType (hFile=0x23c) returned 0x1 [0194.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0194.171] GetFileType (hFile=0x23c) returned 0x1 [0194.171] ReadFile (in: hFile=0x23c, lpBuffer=0x235e500, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235e500*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0194.177] ReadFile (in: hFile=0x23c, lpBuffer=0x235e500, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235e500*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0194.177] ReadFile (in: hFile=0x23c, lpBuffer=0x235e500, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235e500*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0194.178] ReadFile (in: hFile=0x23c, lpBuffer=0x235e500, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235e500*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0194.178] CloseHandle (hObject=0x23c) returned 1 [0194.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", lpFilePart=0x0) returned 0x38 [0194.178] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.png")) returned 1 [0194.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0194.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38 [0194.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39 [0194.180] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0194.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0194.181] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0194.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0194.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0194.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0194.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security", lpFilePart=0x0) returned 0x38 [0194.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\", lpFilePart=0x0) returned 0x39 [0194.181] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0194.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0194.183] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0194.183] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0194.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0194.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0194.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", lpFilePart=0x0) returned 0x41 [0194.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", dwFileAttributes=0x80) returned 1 [0194.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x49 [0194.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0194.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0194.184] GetFileType (hFile=0x15c) returned 0x1 [0194.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0194.185] GetFileType (hFile=0x15c) returned 0x1 [0195.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", lpFilePart=0x0) returned 0x41 [0195.207] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0195.208] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0195.208] GetFileType (hFile=0x23c) returned 0x1 [0195.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0195.208] GetFileType (hFile=0x23c) returned 0x1 [0195.208] ReadFile (in: hFile=0x23c, lpBuffer=0x224d1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x224d1c8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0195.213] ReadFile (in: hFile=0x23c, lpBuffer=0x224d1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x224d1c8*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0195.213] ReadFile (in: hFile=0x23c, lpBuffer=0x224d1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x224d1c8*, lpNumberOfBytesRead=0x2edd68*=0x337, lpOverlapped=0x0) returned 1 [0195.213] ReadFile (in: hFile=0x23c, lpBuffer=0x224d1c8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x224d1c8*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0195.213] CloseHandle (hObject=0x23c) returned 1 [0195.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", lpFilePart=0x0) returned 0x41 [0195.214] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.png")) returned 1 [0195.263] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0195.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0195.263] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.263] GetFileType (hFile=0x15c) returned 0x1 [0195.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0195.264] GetFileType (hFile=0x15c) returned 0x1 [0195.265] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png", lpFilePart=0x0) returned 0x41 [0195.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0195.265] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0195.266] GetFileType (hFile=0x15c) returned 0x1 [0195.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0195.266] GetFileType (hFile=0x15c) returned 0x1 [0195.266] WriteFile (in: hFile=0x15c, lpBuffer=0x225ab20*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x225ab20*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0195.267] CloseHandle (hObject=0x15c) returned 1 [0195.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0195.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0195.267] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.268] GetFileType (hFile=0x15c) returned 0x1 [0195.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0195.268] GetFileType (hFile=0x15c) returned 0x1 [0195.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0195.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0195.269] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Security\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\security\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.269] GetFileType (hFile=0x15c) returned 0x1 [0195.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0195.269] GetFileType (hFile=0x15c) returned 0x1 [0195.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0195.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0195.271] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.271] GetFileType (hFile=0x15c) returned 0x1 [0195.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0195.271] GetFileType (hFile=0x15c) returned 0x1 [0195.272] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png", lpFilePart=0x0) returned 0x38 [0195.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0195.272] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0195.273] GetFileType (hFile=0x15c) returned 0x1 [0195.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0195.273] GetFileType (hFile=0x15c) returned 0x1 [0195.273] WriteFile (in: hFile=0x15c, lpBuffer=0x226c450*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x226c450*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0195.274] CloseHandle (hObject=0x15c) returned 1 [0195.274] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0195.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0195.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.275] GetFileType (hFile=0x15c) returned 0x1 [0195.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0195.275] GetFileType (hFile=0x15c) returned 0x1 [0195.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0195.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0195.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Replicate\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\replicate\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.276] GetFileType (hFile=0x15c) returned 0x1 [0195.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0195.276] GetFileType (hFile=0x15c) returned 0x1 [0195.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0195.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0195.278] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.278] GetFileType (hFile=0x15c) returned 0x1 [0195.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0195.278] GetFileType (hFile=0x15c) returned 0x1 [0195.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0195.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0195.279] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0195.280] GetFileType (hFile=0x15c) returned 0x1 [0195.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0195.280] GetFileType (hFile=0x15c) returned 0x1 [0195.280] WriteFile (in: hFile=0x15c, lpBuffer=0x227dce8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x227dce8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0195.281] CloseHandle (hObject=0x15c) returned 1 [0195.281] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0195.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0195.281] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.281] GetFileType (hFile=0x15c) returned 0x1 [0195.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0195.281] GetFileType (hFile=0x15c) returned 0x1 [0195.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0195.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0195.282] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\10.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\acrobat\\10.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.283] GetFileType (hFile=0x15c) returned 0x1 [0195.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0195.283] GetFileType (hFile=0x15c) returned 0x1 [0195.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.TXT", lpFilePart=0x0) returned 0x29 [0195.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0195.284] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.284] GetFileType (hFile=0x15c) returned 0x1 [0195.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0195.285] GetFileType (hFile=0x15c) returned 0x1 [0195.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png", lpFilePart=0x0) returned 0x29 [0195.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0195.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0195.286] GetFileType (hFile=0x15c) returned 0x1 [0195.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0195.286] GetFileType (hFile=0x15c) returned 0x1 [0195.286] WriteFile (in: hFile=0x15c, lpBuffer=0x228f4f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x228f4f0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0195.288] CloseHandle (hObject=0x15c) returned 1 [0195.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.vbs", lpFilePart=0x0) returned 0x29 [0195.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0195.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\acrobat\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.288] GetFileType (hFile=0x15c) returned 0x1 [0195.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0195.288] GetFileType (hFile=0x15c) returned 0x1 [0195.289] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x55 [0195.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0195.289] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Acrobat\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\acrobat\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0195.289] GetFileType (hFile=0x15c) returned 0x1 [0195.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0195.290] GetFileType (hFile=0x15c) returned 0x1 [0195.291] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0195.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c [0195.291] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x1d [0195.291] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0195.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.291] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0195.292] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0195.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0195.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0195.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0195.292] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM", lpFilePart=0x0) returned 0x1c [0195.292] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\", lpFilePart=0x0) returned 0x1d [0195.292] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0195.292] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0195.293] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0195.294] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0195.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0195.294] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0195.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", lpFilePart=0x0) returned 0x25 [0195.294] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", dwFileAttributes=0x80) returned 1 [0195.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x2d [0195.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0195.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0195.342] GetFileType (hFile=0x15c) returned 0x1 [0195.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0195.342] GetFileType (hFile=0x15c) returned 0x1 [0196.258] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", lpFilePart=0x0) returned 0x25 [0196.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0196.258] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0196.258] GetFileType (hFile=0x23c) returned 0x1 [0196.258] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0196.258] GetFileType (hFile=0x23c) returned 0x1 [0196.258] ReadFile (in: hFile=0x23c, lpBuffer=0x23812f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23812f8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0196.264] ReadFile (in: hFile=0x23c, lpBuffer=0x23812f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23812f8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0196.264] ReadFile (in: hFile=0x23c, lpBuffer=0x23812f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23812f8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0196.264] ReadFile (in: hFile=0x23c, lpBuffer=0x23812f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23812f8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0196.265] CloseHandle (hObject=0x23c) returned 1 [0196.265] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", lpFilePart=0x0) returned 0x25 [0196.265] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.png")) returned 1 [0196.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x2a [0196.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x2b [0196.266] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.267] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0196.268] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0196.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0196.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0196.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0", lpFilePart=0x0) returned 0x2a [0196.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\", lpFilePart=0x0) returned 0x2b [0196.268] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0196.268] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.268] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.268] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.268] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0196.269] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0196.269] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0196.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0196.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0196.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", lpFilePart=0x0) returned 0x33 [0196.269] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", dwFileAttributes=0x80) returned 1 [0196.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3b [0196.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0196.270] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.271] GetFileType (hFile=0x15c) returned 0x1 [0196.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0196.271] GetFileType (hFile=0x15c) returned 0x1 [0196.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", lpFilePart=0x0) returned 0x33 [0196.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0196.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0196.790] GetFileType (hFile=0x23c) returned 0x1 [0196.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0196.790] GetFileType (hFile=0x23c) returned 0x1 [0196.790] ReadFile (in: hFile=0x23c, lpBuffer=0x22702e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22702e0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0196.795] ReadFile (in: hFile=0x23c, lpBuffer=0x22702e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22702e0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0196.795] ReadFile (in: hFile=0x23c, lpBuffer=0x22702e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22702e0*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0196.795] ReadFile (in: hFile=0x23c, lpBuffer=0x22702e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22702e0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0196.796] CloseHandle (hObject=0x23c) returned 1 [0196.796] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", lpFilePart=0x0) returned 0x33 [0196.796] DeleteFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.png")) returned 1 [0196.798] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0196.798] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0196.798] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.798] GetFileType (hFile=0x15c) returned 0x1 [0196.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0196.798] GetFileType (hFile=0x15c) returned 0x1 [0196.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png", lpFilePart=0x0) returned 0x33 [0196.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0196.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.800] GetFileType (hFile=0x15c) returned 0x1 [0196.800] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0196.800] GetFileType (hFile=0x15c) returned 0x1 [0196.800] WriteFile (in: hFile=0x15c, lpBuffer=0x227dbb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x227dbb8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0196.801] CloseHandle (hObject=0x15c) returned 1 [0196.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0196.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0196.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.801] GetFileType (hFile=0x15c) returned 0x1 [0196.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0196.801] GetFileType (hFile=0x15c) returned 0x1 [0196.802] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0196.802] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0196.802] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Reader_10.0.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\arm\\reader_10.0.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.802] GetFileType (hFile=0x15c) returned 0x1 [0196.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0196.802] GetFileType (hFile=0x15c) returned 0x1 [0196.803] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0196.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0196.803] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.803] GetFileType (hFile=0x15c) returned 0x1 [0196.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0196.803] GetFileType (hFile=0x15c) returned 0x1 [0196.804] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png", lpFilePart=0x0) returned 0x25 [0196.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0196.804] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.804] GetFileType (hFile=0x15c) returned 0x1 [0196.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0196.805] GetFileType (hFile=0x15c) returned 0x1 [0196.805] WriteFile (in: hFile=0x15c, lpBuffer=0x228f3d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x228f3d0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0196.805] CloseHandle (hObject=0x15c) returned 1 [0196.806] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0196.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0196.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\arm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.806] GetFileType (hFile=0x15c) returned 0x1 [0196.806] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0196.806] GetFileType (hFile=0x15c) returned 0x1 [0196.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\ARM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0196.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0196.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\ARM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\arm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.809] GetFileType (hFile=0x15c) returned 0x1 [0196.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0196.809] GetFileType (hFile=0x15c) returned 0x1 [0196.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.TXT", lpFilePart=0x0) returned 0x21 [0196.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.TXT" (normalized: "c:\\users\\all users\\adobe\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.810] GetFileType (hFile=0x15c) returned 0x1 [0196.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.811] GetFileType (hFile=0x15c) returned 0x1 [0196.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.png", lpFilePart=0x0) returned 0x21 [0196.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.png" (normalized: "c:\\users\\all users\\adobe\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.812] GetFileType (hFile=0x15c) returned 0x1 [0196.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0196.812] GetFileType (hFile=0x15c) returned 0x1 [0196.812] WriteFile (in: hFile=0x15c, lpBuffer=0x22a0b58*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22a0b58*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0196.813] CloseHandle (hObject=0x15c) returned 1 [0196.813] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\Hack.vbs", lpFilePart=0x0) returned 0x21 [0196.813] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.813] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\Hack.vbs" (normalized: "c:\\users\\all users\\adobe\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.813] GetFileType (hFile=0x15c) returned 0x1 [0196.813] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.813] GetFileType (hFile=0x15c) returned 0x1 [0196.814] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4d [0196.814] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.814] CreateFileW (lpFileName="C:\\Users\\All Users\\Adobe\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\adobe\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.814] GetFileType (hFile=0x15c) returned 0x1 [0196.814] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.814] GetFileType (hFile=0x15c) returned 0x1 [0196.815] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0196.815] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data", lpFilePart=0x0) returned 0x23 [0196.815] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\", lpFilePart=0x0) returned 0x24 [0196.815] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Application Data\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0196.815] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0196.819] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0196.819] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.819] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\Hack.TXT" (normalized: "c:\\users\\all users\\application data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.820] GetFileType (hFile=0x15c) returned 0x1 [0196.820] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.820] GetFileType (hFile=0x15c) returned 0x1 [0196.820] WriteFile (in: hFile=0x15c, lpBuffer=0x22b2558*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22b2558*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0196.821] CloseHandle (hObject=0x15c) returned 1 [0196.821] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\Hack.png", lpFilePart=0x0) returned 0x2c [0196.821] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.821] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\Hack.png" (normalized: "c:\\users\\all users\\application data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.822] GetFileType (hFile=0x15c) returned 0x1 [0196.822] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0196.822] GetFileType (hFile=0x15c) returned 0x1 [0196.822] WriteFile (in: hFile=0x15c, lpBuffer=0x22b35e8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22b35e8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0196.823] CloseHandle (hObject=0x15c) returned 1 [0196.823] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0196.823] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.823] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\Hack.vbs" (normalized: "c:\\users\\all users\\application data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.823] GetFileType (hFile=0x15c) returned 0x1 [0196.823] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.823] GetFileType (hFile=0x15c) returned 0x1 [0196.823] WriteFile (in: hFile=0x15c, lpBuffer=0x22b7110*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22b7110*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0196.824] CloseHandle (hObject=0x15c) returned 1 [0196.824] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0196.824] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.824] CreateFileW (lpFileName="C:\\Users\\All Users\\Application Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\application data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.825] GetFileType (hFile=0x15c) returned 0x1 [0196.825] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.825] GetFileType (hFile=0x15c) returned 0x1 [0196.825] WriteFile (in: hFile=0x15c, lpBuffer=0x22b9ad0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22b9ad0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0196.826] CloseHandle (hObject=0x15c) returned 1 [0196.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0196.826] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop", lpFilePart=0x0) returned 0x1a [0196.826] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\", lpFilePart=0x0) returned 0x1b [0196.826] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Desktop\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0196.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0196.830] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\Hack.TXT", lpFilePart=0x0) returned 0x23 [0196.830] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.830] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\Hack.TXT" (normalized: "c:\\users\\all users\\desktop\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.830] GetFileType (hFile=0x15c) returned 0x1 [0196.830] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.830] GetFileType (hFile=0x15c) returned 0x1 [0196.831] WriteFile (in: hFile=0x15c, lpBuffer=0x22c4f80*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22c4f80*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0196.832] CloseHandle (hObject=0x15c) returned 1 [0196.832] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\Hack.png", lpFilePart=0x0) returned 0x23 [0196.832] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.832] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\Hack.png" (normalized: "c:\\users\\all users\\desktop\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.832] GetFileType (hFile=0x15c) returned 0x1 [0196.832] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0196.832] GetFileType (hFile=0x15c) returned 0x1 [0196.832] WriteFile (in: hFile=0x15c, lpBuffer=0x22c5ff8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22c5ff8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0196.833] CloseHandle (hObject=0x15c) returned 1 [0196.833] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\Hack.vbs", lpFilePart=0x0) returned 0x23 [0196.833] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.833] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\Hack.vbs" (normalized: "c:\\users\\all users\\desktop\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.834] GetFileType (hFile=0x15c) returned 0x1 [0196.834] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.834] GetFileType (hFile=0x15c) returned 0x1 [0196.834] WriteFile (in: hFile=0x15c, lpBuffer=0x22c9ad8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22c9ad8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0196.835] CloseHandle (hObject=0x15c) returned 1 [0196.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4f [0196.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.835] CreateFileW (lpFileName="C:\\Users\\All Users\\Desktop\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\desktop\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.835] GetFileType (hFile=0x15c) returned 0x1 [0196.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.835] GetFileType (hFile=0x15c) returned 0x1 [0196.835] WriteFile (in: hFile=0x15c, lpBuffer=0x22cc468*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22cc468*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0196.836] CloseHandle (hObject=0x15c) returned 1 [0196.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0196.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents", lpFilePart=0x0) returned 0x1c [0196.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\", lpFilePart=0x0) returned 0x1d [0196.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Documents\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0196.836] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0196.840] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0196.840] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.840] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\Hack.TXT" (normalized: "c:\\users\\all users\\documents\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.840] GetFileType (hFile=0x15c) returned 0x1 [0196.840] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.840] GetFileType (hFile=0x15c) returned 0x1 [0196.841] WriteFile (in: hFile=0x15c, lpBuffer=0x22d7950*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22d7950*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0196.842] CloseHandle (hObject=0x15c) returned 1 [0196.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\Hack.png", lpFilePart=0x0) returned 0x25 [0196.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.842] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\Hack.png" (normalized: "c:\\users\\all users\\documents\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.842] GetFileType (hFile=0x15c) returned 0x1 [0196.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0196.842] GetFileType (hFile=0x15c) returned 0x1 [0196.842] WriteFile (in: hFile=0x15c, lpBuffer=0x22d89d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22d89d0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0196.843] CloseHandle (hObject=0x15c) returned 1 [0196.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0196.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.843] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\Hack.vbs" (normalized: "c:\\users\\all users\\documents\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.843] GetFileType (hFile=0x15c) returned 0x1 [0196.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.843] GetFileType (hFile=0x15c) returned 0x1 [0196.844] WriteFile (in: hFile=0x15c, lpBuffer=0x22dc4c8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22dc4c8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0196.844] CloseHandle (hObject=0x15c) returned 1 [0196.844] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0196.844] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.844] CreateFileW (lpFileName="C:\\Users\\All Users\\Documents\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\documents\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.845] GetFileType (hFile=0x15c) returned 0x1 [0196.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.845] GetFileType (hFile=0x15c) returned 0x1 [0196.845] WriteFile (in: hFile=0x15c, lpBuffer=0x22dee68*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22dee68*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0196.846] CloseHandle (hObject=0x15c) returned 1 [0196.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0196.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites", lpFilePart=0x0) returned 0x1c [0196.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\", lpFilePart=0x0) returned 0x1d [0196.846] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Favorites\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0xffffffffffffffff [0196.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edec0) returned 1 [0196.849] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0196.850] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.850] CreateFileW (lpFileName="C:\\Users\\All Users\\Favorites\\Hack.TXT" (normalized: "c:\\users\\all users\\favorites\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.850] GetFileType (hFile=0x15c) returned 0x1 [0196.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.850] GetFileType (hFile=0x15c) returned 0x1 [0196.850] WriteFile (in: hFile=0x15c, lpBuffer=0x22ea350*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22ea350*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0196.851] CloseHandle (hObject=0x15c) returned 1 [0196.851] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\Hack.png", lpFilePart=0x0) returned 0x25 [0196.851] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0196.851] CreateFileW (lpFileName="C:\\Users\\All Users\\Favorites\\Hack.png" (normalized: "c:\\users\\all users\\favorites\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.852] GetFileType (hFile=0x15c) returned 0x1 [0196.852] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0196.852] GetFileType (hFile=0x15c) returned 0x1 [0196.852] WriteFile (in: hFile=0x15c, lpBuffer=0x22eb3d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22eb3d0*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0196.852] CloseHandle (hObject=0x15c) returned 1 [0196.853] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0196.853] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.853] CreateFileW (lpFileName="C:\\Users\\All Users\\Favorites\\Hack.vbs" (normalized: "c:\\users\\all users\\favorites\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.853] GetFileType (hFile=0x15c) returned 0x1 [0196.853] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.853] GetFileType (hFile=0x15c) returned 0x1 [0196.853] WriteFile (in: hFile=0x15c, lpBuffer=0x22eeec8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x22eeec8*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0196.854] CloseHandle (hObject=0x15c) returned 1 [0196.854] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0196.854] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0196.854] CreateFileW (lpFileName="C:\\Users\\All Users\\Favorites\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\favorites\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0196.854] GetFileType (hFile=0x15c) returned 0x1 [0196.854] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0196.854] GetFileType (hFile=0x15c) returned 0x1 [0196.855] WriteFile (in: hFile=0x15c, lpBuffer=0x22f1868*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x22f1868*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0196.856] CloseHandle (hObject=0x15c) returned 1 [0196.856] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0196.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0196.857] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d [0196.857] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0196.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.857] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.858] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.859] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.860] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0196.860] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0196.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0196.861] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0196.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0196.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft", lpFilePart=0x0) returned 0x1c [0196.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\", lpFilePart=0x0) returned 0x1d [0196.861] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x4cf960 [0196.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.861] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.862] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.863] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0196.864] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0196.864] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0196.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0196.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0196.864] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x25 [0196.864] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png", dwFileAttributes=0x80) returned 1 [0196.866] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x2d [0196.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0196.866] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0196.866] GetFileType (hFile=0x15c) returned 0x1 [0196.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0196.866] GetFileType (hFile=0x15c) returned 0x1 [0197.380] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x25 [0197.380] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0197.380] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0197.381] GetFileType (hFile=0x23c) returned 0x1 [0197.381] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0197.381] GetFileType (hFile=0x23c) returned 0x1 [0197.381] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1ee8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0197.386] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1ee8*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0197.386] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1ee8*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0197.387] ReadFile (in: hFile=0x23c, lpBuffer=0x23e1ee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23e1ee8*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0197.387] CloseHandle (hObject=0x23c) returned 1 [0197.387] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x25 [0197.387] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\hack.png")) returned 1 [0197.388] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0197.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27 [0197.388] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28 [0197.388] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.389] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0197.389] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0197.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0197.389] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0197.390] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0197.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance", lpFilePart=0x0) returned 0x27 [0197.390] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\", lpFilePart=0x0) returned 0x28 [0197.390] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0197.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.390] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0197.391] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0197.391] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0197.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0197.391] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0197.391] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", lpFilePart=0x0) returned 0x30 [0197.391] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", dwFileAttributes=0x80) returned 1 [0197.392] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x38 [0197.392] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0197.392] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0197.393] GetFileType (hFile=0x15c) returned 0x1 [0197.393] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0197.393] GetFileType (hFile=0x15c) returned 0x1 [0197.932] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", lpFilePart=0x0) returned 0x30 [0197.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0197.933] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0197.933] GetFileType (hFile=0x23c) returned 0x1 [0197.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0197.933] GetFileType (hFile=0x23c) returned 0x1 [0197.933] ReadFile (in: hFile=0x23c, lpBuffer=0x22d02a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d02a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0197.938] ReadFile (in: hFile=0x23c, lpBuffer=0x22d02a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d02a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0197.938] ReadFile (in: hFile=0x23c, lpBuffer=0x22d02a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d02a0*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0197.938] ReadFile (in: hFile=0x23c, lpBuffer=0x22d02a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d02a0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0197.939] CloseHandle (hObject=0x23c) returned 1 [0197.939] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", lpFilePart=0x0) returned 0x30 [0197.939] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.png")) returned 1 [0197.940] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0197.940] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e [0197.940] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f [0197.940] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.941] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0197.941] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0197.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0197.941] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0197.941] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0197.941] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client", lpFilePart=0x0) returned 0x2e [0197.941] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\", lpFilePart=0x0) returned 0x2f [0197.942] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0197.942] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0197.943] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0197.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0197.943] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0197.943] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", lpFilePart=0x0) returned 0x37 [0197.943] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", dwFileAttributes=0x80) returned 1 [0197.944] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3f [0197.944] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0197.944] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0197.944] GetFileType (hFile=0x15c) returned 0x1 [0197.944] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0197.944] GetFileType (hFile=0x15c) returned 0x1 [0198.444] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", lpFilePart=0x0) returned 0x37 [0198.444] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0198.444] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0198.444] GetFileType (hFile=0x23c) returned 0x1 [0198.444] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0198.444] GetFileType (hFile=0x23c) returned 0x1 [0198.444] ReadFile (in: hFile=0x23c, lpBuffer=0x23be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23be7e0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0198.454] ReadFile (in: hFile=0x23c, lpBuffer=0x23be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23be7e0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0198.454] ReadFile (in: hFile=0x23c, lpBuffer=0x23be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23be7e0*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0198.455] ReadFile (in: hFile=0x23c, lpBuffer=0x23be7e0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23be7e0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0198.455] CloseHandle (hObject=0x23c) returned 1 [0198.455] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", lpFilePart=0x0) returned 0x37 [0198.455] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.png")) returned 1 [0198.456] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0198.456] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32 [0198.456] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33 [0198.456] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.457] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0198.457] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0198.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0198.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0198.458] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0198.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0", lpFilePart=0x0) returned 0x32 [0198.458] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\", lpFilePart=0x0) returned 0x33 [0198.458] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0198.458] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.458] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.458] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.458] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.458] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.459] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0198.459] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0198.459] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0198.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0198.459] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0198.459] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", lpFilePart=0x0) returned 0x3b [0198.459] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", dwFileAttributes=0x80) returned 1 [0198.460] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x43 [0198.460] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0198.460] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0198.460] GetFileType (hFile=0x15c) returned 0x1 [0198.460] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0198.461] GetFileType (hFile=0x15c) returned 0x1 [0199.225] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", lpFilePart=0x0) returned 0x3b [0199.225] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0199.225] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0199.225] GetFileType (hFile=0x23c) returned 0x1 [0199.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0199.225] GetFileType (hFile=0x23c) returned 0x1 [0199.225] ReadFile (in: hFile=0x23c, lpBuffer=0x22acfe0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22acfe0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0199.230] ReadFile (in: hFile=0x23c, lpBuffer=0x22acfe0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22acfe0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0199.231] ReadFile (in: hFile=0x23c, lpBuffer=0x22acfe0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22acfe0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0199.231] ReadFile (in: hFile=0x23c, lpBuffer=0x22acfe0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22acfe0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0199.231] CloseHandle (hObject=0x23c) returned 1 [0199.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", lpFilePart=0x0) returned 0x3b [0199.231] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.png")) returned 1 [0199.232] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0199.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38 [0199.233] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39 [0199.233] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.233] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.234] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0199.234] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0199.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0199.234] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0199.234] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0199.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US", lpFilePart=0x0) returned 0x38 [0199.234] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\", lpFilePart=0x0) returned 0x39 [0199.235] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x4cf960 [0199.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.235] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0199.236] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0199.236] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0199.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0199.237] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0199.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", lpFilePart=0x0) returned 0x41 [0199.237] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", dwFileAttributes=0x80) returned 1 [0199.237] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x49 [0199.237] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0199.238] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0199.238] GetFileType (hFile=0x15c) returned 0x1 [0199.238] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0199.238] GetFileType (hFile=0x15c) returned 0x1 [0200.247] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", lpFilePart=0x0) returned 0x41 [0200.247] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0200.247] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0200.247] GetFileType (hFile=0x23c) returned 0x1 [0200.248] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0200.248] GetFileType (hFile=0x23c) returned 0x1 [0200.248] ReadFile (in: hFile=0x23c, lpBuffer=0x239dce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x239dce0*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0200.253] ReadFile (in: hFile=0x23c, lpBuffer=0x239dce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x239dce0*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0200.253] ReadFile (in: hFile=0x23c, lpBuffer=0x239dce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x239dce0*, lpNumberOfBytesRead=0x2edd68*=0x337, lpOverlapped=0x0) returned 1 [0200.253] ReadFile (in: hFile=0x23c, lpBuffer=0x239dce0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x239dce0*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0200.253] CloseHandle (hObject=0x23c) returned 1 [0200.253] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", lpFilePart=0x0) returned 0x41 [0200.253] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.png")) returned 1 [0200.257] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.TXT", lpFilePart=0x0) returned 0x41 [0200.257] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0200.257] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.257] GetFileType (hFile=0x15c) returned 0x1 [0200.257] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0200.258] GetFileType (hFile=0x15c) returned 0x1 [0200.258] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png", lpFilePart=0x0) returned 0x41 [0200.258] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0200.259] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0200.259] GetFileType (hFile=0x15c) returned 0x1 [0200.259] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0200.259] GetFileType (hFile=0x15c) returned 0x1 [0200.259] WriteFile (in: hFile=0x15c, lpBuffer=0x23ab750*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x23ab750*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0200.260] CloseHandle (hObject=0x15c) returned 1 [0200.260] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.vbs", lpFilePart=0x0) returned 0x41 [0200.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0200.260] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.261] GetFileType (hFile=0x15c) returned 0x1 [0200.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0200.261] GetFileType (hFile=0x15c) returned 0x1 [0200.261] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6d [0200.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0200.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\en-US\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\en-us\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.262] GetFileType (hFile=0x15c) returned 0x1 [0200.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0200.262] GetFileType (hFile=0x15c) returned 0x1 [0200.263] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.TXT", lpFilePart=0x0) returned 0x3b [0200.263] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0200.263] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.263] GetFileType (hFile=0x15c) returned 0x1 [0200.263] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0200.263] GetFileType (hFile=0x15c) returned 0x1 [0200.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png", lpFilePart=0x0) returned 0x3b [0200.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0200.264] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0200.264] GetFileType (hFile=0x15c) returned 0x1 [0200.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0200.264] GetFileType (hFile=0x15c) returned 0x1 [0200.264] WriteFile (in: hFile=0x15c, lpBuffer=0x23bd080*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23bd080*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0200.265] CloseHandle (hObject=0x15c) returned 1 [0200.265] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.vbs", lpFilePart=0x0) returned 0x3b [0200.265] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0200.265] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.265] GetFileType (hFile=0x15c) returned 0x1 [0200.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0200.265] GetFileType (hFile=0x15c) returned 0x1 [0200.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x67 [0200.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0200.266] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\1.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\1.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.266] GetFileType (hFile=0x15c) returned 0x1 [0200.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0200.267] GetFileType (hFile=0x15c) returned 0x1 [0200.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0200.267] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0200.267] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.268] GetFileType (hFile=0x15c) returned 0x1 [0200.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0200.268] GetFileType (hFile=0x15c) returned 0x1 [0200.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png", lpFilePart=0x0) returned 0x37 [0200.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0200.268] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0200.269] GetFileType (hFile=0x15c) returned 0x1 [0200.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0200.269] GetFileType (hFile=0x15c) returned 0x1 [0200.269] WriteFile (in: hFile=0x15c, lpBuffer=0x23ce948*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23ce948*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0200.270] CloseHandle (hObject=0x15c) returned 1 [0200.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0200.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0200.270] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.270] GetFileType (hFile=0x15c) returned 0x1 [0200.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0200.270] GetFileType (hFile=0x15c) returned 0x1 [0200.271] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0200.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0200.271] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Client\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\assistance\\client\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.344] GetFileType (hFile=0x15c) returned 0x1 [0200.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0200.344] GetFileType (hFile=0x15c) returned 0x1 [0200.344] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0200.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0200.345] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.345] GetFileType (hFile=0x15c) returned 0x1 [0200.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0200.345] GetFileType (hFile=0x15c) returned 0x1 [0200.346] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png", lpFilePart=0x0) returned 0x30 [0200.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0200.346] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0200.346] GetFileType (hFile=0x15c) returned 0x1 [0200.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0200.346] GetFileType (hFile=0x15c) returned 0x1 [0200.346] WriteFile (in: hFile=0x15c, lpBuffer=0x23e01d0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23e01d0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0200.347] CloseHandle (hObject=0x15c) returned 1 [0200.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0200.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0200.348] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\assistance\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.353] GetFileType (hFile=0x15c) returned 0x1 [0200.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0200.353] GetFileType (hFile=0x15c) returned 0x1 [0200.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Assistance\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0200.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0200.354] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Assistance\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\assistance\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0200.355] GetFileType (hFile=0x15c) returned 0x1 [0200.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0200.355] GetFileType (hFile=0x15c) returned 0x1 [0200.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0200.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0200.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24 [0200.356] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.356] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0200.357] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0200.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0200.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0200.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0200.357] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto", lpFilePart=0x0) returned 0x23 [0200.357] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\", lpFilePart=0x0) returned 0x24 [0200.357] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0200.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.357] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.358] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.358] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.358] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.358] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0200.358] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0200.358] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0200.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0200.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0200.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", lpFilePart=0x0) returned 0x2c [0200.358] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", dwFileAttributes=0x80) returned 1 [0200.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x34 [0200.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0200.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0200.360] GetFileType (hFile=0x15c) returned 0x1 [0200.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0200.360] GetFileType (hFile=0x15c) returned 0x1 [0200.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", lpFilePart=0x0) returned 0x2c [0200.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0200.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0200.982] GetFileType (hFile=0x23c) returned 0x1 [0200.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0200.982] GetFileType (hFile=0x23c) returned 0x1 [0200.982] ReadFile (in: hFile=0x23c, lpBuffer=0x22d2940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d2940*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0200.988] ReadFile (in: hFile=0x23c, lpBuffer=0x22d2940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d2940*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0200.988] ReadFile (in: hFile=0x23c, lpBuffer=0x22d2940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d2940*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0200.989] ReadFile (in: hFile=0x23c, lpBuffer=0x22d2940, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22d2940*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0200.989] CloseHandle (hObject=0x23c) returned 1 [0200.989] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", lpFilePart=0x0) returned 0x2c [0200.989] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.png")) returned 1 [0200.991] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0200.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0200.991] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28 [0200.991] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0200.991] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.991] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0200.992] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0200.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0200.992] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0200.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0200.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS", lpFilePart=0x0) returned 0x27 [0200.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\", lpFilePart=0x0) returned 0x28 [0200.992] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0200.992] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.992] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.993] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.993] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.993] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.993] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0200.993] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0200.993] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0200.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0200.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0200.993] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", lpFilePart=0x0) returned 0x30 [0200.993] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", dwFileAttributes=0x80) returned 1 [0200.994] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x38 [0200.994] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0200.994] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0200.995] GetFileType (hFile=0x15c) returned 0x1 [0200.995] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0200.995] GetFileType (hFile=0x15c) returned 0x1 [0201.924] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", lpFilePart=0x0) returned 0x30 [0201.924] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0201.924] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0201.924] GetFileType (hFile=0x23c) returned 0x1 [0201.924] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0201.924] GetFileType (hFile=0x23c) returned 0x1 [0201.924] ReadFile (in: hFile=0x23c, lpBuffer=0x23c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23c0d18*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0201.929] ReadFile (in: hFile=0x23c, lpBuffer=0x23c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23c0d18*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0201.930] ReadFile (in: hFile=0x23c, lpBuffer=0x23c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23c0d18*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0201.930] ReadFile (in: hFile=0x23c, lpBuffer=0x23c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23c0d18*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0201.930] CloseHandle (hObject=0x23c) returned 1 [0201.930] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", lpFilePart=0x0) returned 0x30 [0201.930] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.png")) returned 1 [0201.932] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0201.932] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0201.932] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0201.932] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0201.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.932] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.933] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0201.933] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0201.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0201.933] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0201.933] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0201.933] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys", lpFilePart=0x0) returned 0x33 [0201.933] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0201.933] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0201.933] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.933] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.933] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.933] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.934] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0201.934] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0201.934] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0201.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0201.934] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0201.934] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0201.934] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", dwFileAttributes=0x80) returned 1 [0201.935] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x44 [0201.935] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0201.935] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0201.935] GetFileType (hFile=0x15c) returned 0x1 [0201.936] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0201.936] GetFileType (hFile=0x15c) returned 0x1 [0202.545] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0202.545] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0202.545] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0202.545] GetFileType (hFile=0x23c) returned 0x1 [0202.545] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0202.545] GetFileType (hFile=0x23c) returned 0x1 [0202.546] ReadFile (in: hFile=0x23c, lpBuffer=0x22af208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22af208*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0202.552] ReadFile (in: hFile=0x23c, lpBuffer=0x22af208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22af208*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0202.552] ReadFile (in: hFile=0x23c, lpBuffer=0x22af208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22af208*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0202.552] ReadFile (in: hFile=0x23c, lpBuffer=0x22af208, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22af208*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0202.552] CloseHandle (hObject=0x23c) returned 1 [0202.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0202.553] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.png")) returned 1 [0202.557] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0202.557] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0202.557] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0202.557] GetFileType (hFile=0x15c) returned 0x1 [0202.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0202.557] GetFileType (hFile=0x15c) returned 0x1 [0202.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0202.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0202.558] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0202.559] GetFileType (hFile=0x15c) returned 0x1 [0202.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0202.559] GetFileType (hFile=0x15c) returned 0x1 [0202.559] WriteFile (in: hFile=0x15c, lpBuffer=0x22bcb40*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22bcb40*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0202.560] CloseHandle (hObject=0x15c) returned 1 [0202.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0202.560] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0202.560] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0202.560] GetFileType (hFile=0x15c) returned 0x1 [0202.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0202.560] GetFileType (hFile=0x15c) returned 0x1 [0202.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0202.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0202.561] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\machinekeys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0202.561] GetFileType (hFile=0x15c) returned 0x1 [0202.561] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0202.561] GetFileType (hFile=0x15c) returned 0x1 [0202.562] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0202.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0202.562] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0202.563] GetFileType (hFile=0x15c) returned 0x1 [0202.563] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0202.563] GetFileType (hFile=0x15c) returned 0x1 [0202.563] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png", lpFilePart=0x0) returned 0x30 [0202.563] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0202.563] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0202.564] GetFileType (hFile=0x15c) returned 0x1 [0202.564] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0202.564] GetFileType (hFile=0x15c) returned 0x1 [0202.564] WriteFile (in: hFile=0x15c, lpBuffer=0x22ce418*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22ce418*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0202.565] CloseHandle (hObject=0x15c) returned 1 [0202.565] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0202.565] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0202.565] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0202.566] GetFileType (hFile=0x15c) returned 0x1 [0202.566] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0202.566] GetFileType (hFile=0x15c) returned 0x1 [0202.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0202.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0202.568] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\DSS\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\dss\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0202.568] GetFileType (hFile=0x15c) returned 0x1 [0202.568] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0202.568] GetFileType (hFile=0x15c) returned 0x1 [0202.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0202.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0202.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29 [0202.569] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0202.569] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0202.570] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0202.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0202.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0202.570] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0202.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys", lpFilePart=0x0) returned 0x28 [0202.570] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\", lpFilePart=0x0) returned 0x29 [0202.570] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0202.570] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0202.571] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0202.571] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0202.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0202.571] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0202.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", lpFilePart=0x0) returned 0x31 [0202.571] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", dwFileAttributes=0x80) returned 1 [0202.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x39 [0202.572] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0202.572] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0202.589] GetFileType (hFile=0x15c) returned 0x1 [0202.589] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0202.590] GetFileType (hFile=0x15c) returned 0x1 [0203.077] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", lpFilePart=0x0) returned 0x31 [0203.077] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0203.077] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0203.077] GetFileType (hFile=0x23c) returned 0x1 [0203.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0203.078] GetFileType (hFile=0x23c) returned 0x1 [0203.078] ReadFile (in: hFile=0x23c, lpBuffer=0x23bfc98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bfc98*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0203.083] ReadFile (in: hFile=0x23c, lpBuffer=0x23bfc98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bfc98*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0203.083] ReadFile (in: hFile=0x23c, lpBuffer=0x23bfc98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bfc98*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0203.083] ReadFile (in: hFile=0x23c, lpBuffer=0x23bfc98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23bfc98*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0203.083] CloseHandle (hObject=0x23c) returned 1 [0203.083] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", lpFilePart=0x0) returned 0x31 [0203.083] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.png")) returned 1 [0203.087] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.TXT", lpFilePart=0x0) returned 0x31 [0203.087] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0203.087] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0203.087] GetFileType (hFile=0x15c) returned 0x1 [0203.087] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0203.087] GetFileType (hFile=0x15c) returned 0x1 [0203.088] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png", lpFilePart=0x0) returned 0x31 [0203.088] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0203.088] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0203.088] GetFileType (hFile=0x15c) returned 0x1 [0203.088] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0203.088] GetFileType (hFile=0x15c) returned 0x1 [0203.088] WriteFile (in: hFile=0x15c, lpBuffer=0x23cd570*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23cd570*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0203.089] CloseHandle (hObject=0x15c) returned 1 [0203.089] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.vbs", lpFilePart=0x0) returned 0x31 [0203.090] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0203.090] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0203.090] GetFileType (hFile=0x15c) returned 0x1 [0203.090] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0203.090] GetFileType (hFile=0x15c) returned 0x1 [0203.091] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5d [0203.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0203.091] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Keys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\keys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0203.091] GetFileType (hFile=0x15c) returned 0x1 [0203.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0203.091] GetFileType (hFile=0x15c) returned 0x1 [0203.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0203.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0203.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28 [0203.092] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0203.092] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.092] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.092] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.092] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.093] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.093] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.093] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.093] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0203.093] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0203.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0203.093] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0203.093] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0203.093] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA", lpFilePart=0x0) returned 0x27 [0203.093] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\", lpFilePart=0x0) returned 0x28 [0203.093] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0203.093] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0203.094] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0203.094] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0203.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0203.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0203.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", lpFilePart=0x0) returned 0x30 [0203.095] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", dwFileAttributes=0x80) returned 1 [0203.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x38 [0203.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0203.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0203.096] GetFileType (hFile=0x15c) returned 0x1 [0203.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0203.096] GetFileType (hFile=0x15c) returned 0x1 [0203.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", lpFilePart=0x0) returned 0x30 [0203.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0203.665] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0203.666] GetFileType (hFile=0x23c) returned 0x1 [0203.666] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0203.666] GetFileType (hFile=0x23c) returned 0x1 [0203.666] ReadFile (in: hFile=0x23c, lpBuffer=0x229ef58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229ef58*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0203.668] ReadFile (in: hFile=0x23c, lpBuffer=0x229ef58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229ef58*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0203.671] ReadFile (in: hFile=0x23c, lpBuffer=0x229ef58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229ef58*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0203.671] ReadFile (in: hFile=0x23c, lpBuffer=0x229ef58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229ef58*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0203.671] CloseHandle (hObject=0x23c) returned 1 [0203.671] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", lpFilePart=0x0) returned 0x30 [0203.671] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.png")) returned 1 [0203.673] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0203.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0203.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0203.673] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0203.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.673] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.674] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.674] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0203.674] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0203.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0203.674] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0203.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0203.674] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys", lpFilePart=0x0) returned 0x33 [0203.674] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\", lpFilePart=0x0) returned 0x34 [0203.674] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0203.674] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.674] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.675] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.675] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.675] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0203.675] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0203.675] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0203.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0203.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0203.675] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0203.675] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", dwFileAttributes=0x80) returned 1 [0203.676] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x44 [0203.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0203.676] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0203.677] GetFileType (hFile=0x15c) returned 0x1 [0203.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0203.677] GetFileType (hFile=0x15c) returned 0x1 [0204.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0204.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0204.178] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0204.179] GetFileType (hFile=0x23c) returned 0x1 [0204.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0204.179] GetFileType (hFile=0x23c) returned 0x1 [0204.179] ReadFile (in: hFile=0x23c, lpBuffer=0x238d3a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x238d3a0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0204.184] ReadFile (in: hFile=0x23c, lpBuffer=0x238d3a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x238d3a0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0204.184] ReadFile (in: hFile=0x23c, lpBuffer=0x238d3a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x238d3a0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0204.184] ReadFile (in: hFile=0x23c, lpBuffer=0x238d3a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x238d3a0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0204.184] CloseHandle (hObject=0x23c) returned 1 [0204.185] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0204.185] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.png")) returned 1 [0204.188] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0204.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0204.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.189] GetFileType (hFile=0x15c) returned 0x1 [0204.189] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0204.189] GetFileType (hFile=0x15c) returned 0x1 [0204.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png", lpFilePart=0x0) returned 0x3c [0204.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0204.189] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0204.190] GetFileType (hFile=0x15c) returned 0x1 [0204.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0204.190] GetFileType (hFile=0x15c) returned 0x1 [0204.190] WriteFile (in: hFile=0x15c, lpBuffer=0x239acd8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x239acd8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0204.191] CloseHandle (hObject=0x15c) returned 1 [0204.191] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0204.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0204.191] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.191] GetFileType (hFile=0x15c) returned 0x1 [0204.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0204.191] GetFileType (hFile=0x15c) returned 0x1 [0204.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0204.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0204.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\MachineKeys\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\machinekeys\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.192] GetFileType (hFile=0x15c) returned 0x1 [0204.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0204.193] GetFileType (hFile=0x15c) returned 0x1 [0204.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0204.193] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0204.193] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x31 [0204.193] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0204.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0204.195] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0204.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0204.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0204.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0204.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18", lpFilePart=0x0) returned 0x30 [0204.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\", lpFilePart=0x0) returned 0x31 [0204.195] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0204.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0204.196] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0204.197] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0204.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0204.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0204.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", lpFilePart=0x0) returned 0x39 [0204.197] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", dwFileAttributes=0x80) returned 1 [0204.198] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x41 [0204.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0204.198] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0204.198] GetFileType (hFile=0x15c) returned 0x1 [0204.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0204.198] GetFileType (hFile=0x15c) returned 0x1 [0204.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", lpFilePart=0x0) returned 0x39 [0204.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0204.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0204.788] GetFileType (hFile=0x23c) returned 0x1 [0204.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0204.788] GetFileType (hFile=0x23c) returned 0x1 [0204.788] ReadFile (in: hFile=0x23c, lpBuffer=0x228dfa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x228dfa0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0204.792] ReadFile (in: hFile=0x23c, lpBuffer=0x228dfa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x228dfa0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0204.794] ReadFile (in: hFile=0x23c, lpBuffer=0x228dfa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x228dfa0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0204.794] ReadFile (in: hFile=0x23c, lpBuffer=0x228dfa0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x228dfa0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0204.794] CloseHandle (hObject=0x23c) returned 1 [0204.794] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", lpFilePart=0x0) returned 0x39 [0204.794] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.png")) returned 1 [0204.796] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0204.796] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0204.796] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.796] GetFileType (hFile=0x15c) returned 0x1 [0204.796] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0204.796] GetFileType (hFile=0x15c) returned 0x1 [0204.797] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png", lpFilePart=0x0) returned 0x39 [0204.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0204.797] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0204.798] GetFileType (hFile=0x15c) returned 0x1 [0204.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0204.798] GetFileType (hFile=0x15c) returned 0x1 [0204.798] WriteFile (in: hFile=0x15c, lpBuffer=0x229b8b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x229b8b8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0204.799] CloseHandle (hObject=0x15c) returned 1 [0204.799] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0204.799] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0204.799] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.799] GetFileType (hFile=0x15c) returned 0x1 [0204.799] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0204.799] GetFileType (hFile=0x15c) returned 0x1 [0204.800] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0204.800] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0204.800] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\S-1-5-18\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\s-1-5-18\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.800] GetFileType (hFile=0x15c) returned 0x1 [0204.801] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0204.801] GetFileType (hFile=0x15c) returned 0x1 [0204.801] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0204.801] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0204.801] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.802] GetFileType (hFile=0x15c) returned 0x1 [0204.802] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0204.802] GetFileType (hFile=0x15c) returned 0x1 [0204.803] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png", lpFilePart=0x0) returned 0x30 [0204.803] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0204.803] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0204.803] GetFileType (hFile=0x15c) returned 0x1 [0204.803] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0204.804] GetFileType (hFile=0x15c) returned 0x1 [0204.804] WriteFile (in: hFile=0x15c, lpBuffer=0x22ad168*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22ad168*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0204.805] CloseHandle (hObject=0x15c) returned 1 [0204.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0204.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0204.805] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.805] GetFileType (hFile=0x15c) returned 0x1 [0204.805] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0204.805] GetFileType (hFile=0x15c) returned 0x1 [0204.806] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0204.806] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0204.806] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\RSA\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\rsa\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.807] GetFileType (hFile=0x15c) returned 0x1 [0204.807] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0204.807] GetFileType (hFile=0x15c) returned 0x1 [0204.807] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0204.807] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0204.807] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.808] GetFileType (hFile=0x15c) returned 0x1 [0204.808] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0204.808] GetFileType (hFile=0x15c) returned 0x1 [0204.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png", lpFilePart=0x0) returned 0x2c [0204.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0204.809] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0204.809] GetFileType (hFile=0x15c) returned 0x1 [0204.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0204.809] GetFileType (hFile=0x15c) returned 0x1 [0204.809] WriteFile (in: hFile=0x15c, lpBuffer=0x22be9b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22be9b0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0204.810] CloseHandle (hObject=0x15c) returned 1 [0204.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0204.810] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0204.810] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\crypto\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.811] GetFileType (hFile=0x15c) returned 0x1 [0204.811] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0204.811] GetFileType (hFile=0x15c) returned 0x1 [0204.812] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0204.812] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0204.812] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Crypto\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\crypto\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0204.812] GetFileType (hFile=0x15c) returned 0x1 [0204.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0204.812] GetFileType (hFile=0x15c) returned 0x1 [0204.816] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0204.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0204.816] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x2a [0204.816] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0204.816] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.816] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.817] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.817] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.817] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.817] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.817] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.817] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0204.817] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0204.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0204.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0204.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0204.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage", lpFilePart=0x0) returned 0x29 [0204.818] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\", lpFilePart=0x0) returned 0x2a [0204.818] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0204.818] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.818] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.818] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.818] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.819] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.819] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.819] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0204.819] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0204.819] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0204.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0204.819] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0204.819] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", lpFilePart=0x0) returned 0x32 [0204.819] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", dwFileAttributes=0x80) returned 1 [0204.820] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3a [0204.820] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0204.820] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0204.821] GetFileType (hFile=0x15c) returned 0x1 [0204.821] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0204.821] GetFileType (hFile=0x15c) returned 0x1 [0205.428] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", lpFilePart=0x0) returned 0x32 [0205.429] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0205.429] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0205.429] GetFileType (hFile=0x23c) returned 0x1 [0205.429] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0205.429] GetFileType (hFile=0x23c) returned 0x1 [0205.429] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b0fd8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0205.434] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b0fd8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0205.434] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b0fd8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0205.434] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0fd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b0fd8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0205.434] CloseHandle (hObject=0x23c) returned 1 [0205.435] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", lpFilePart=0x0) returned 0x32 [0205.435] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.png")) returned 1 [0205.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0205.483] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30 [0205.483] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x31 [0205.483] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.484] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0205.485] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0205.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0205.485] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0205.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0205.485] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device", lpFilePart=0x0) returned 0x30 [0205.485] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\", lpFilePart=0x0) returned 0x31 [0205.485] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0205.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.485] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0205.486] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0205.486] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0205.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0205.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0205.486] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", lpFilePart=0x0) returned 0x39 [0205.486] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", dwFileAttributes=0x80) returned 1 [0205.487] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x41 [0205.487] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0205.487] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0205.488] GetFileType (hFile=0x15c) returned 0x1 [0205.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0205.488] GetFileType (hFile=0x15c) returned 0x1 [0206.113] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", lpFilePart=0x0) returned 0x39 [0206.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0206.113] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0206.114] GetFileType (hFile=0x23c) returned 0x1 [0206.117] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0206.117] GetFileType (hFile=0x23c) returned 0x1 [0206.117] ReadFile (in: hFile=0x23c, lpBuffer=0x229fef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229fef0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0206.124] ReadFile (in: hFile=0x23c, lpBuffer=0x229fef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229fef0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0206.124] ReadFile (in: hFile=0x23c, lpBuffer=0x229fef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229fef0*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0206.127] ReadFile (in: hFile=0x23c, lpBuffer=0x229fef0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x229fef0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0206.127] CloseHandle (hObject=0x23c) returned 1 [0206.128] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", lpFilePart=0x0) returned 0x39 [0206.128] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.png")) returned 1 [0206.129] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0206.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57 [0206.129] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x58 [0206.129] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0206.129] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.130] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0206.130] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0206.131] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0206.131] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0206.131] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}", lpFilePart=0x0) returned 0x57 [0206.131] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\", lpFilePart=0x0) returned 0x58 [0206.131] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0206.131] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.131] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.131] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.131] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.131] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.132] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.132] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.132] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.132] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.132] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.132] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0206.132] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0206.132] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0206.132] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", lpFilePart=0x0) returned 0x66 [0206.132] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\background.png", dwFileAttributes=0x80) returned 0 [0206.136] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0206.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0206.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.136] GetFileType (hFile=0x15c) returned 0x1 [0206.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0206.136] GetFileType (hFile=0x15c) returned 0x1 [0206.137] WriteFile (in: hFile=0x15c, lpBuffer=0x22b2130*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22b2130*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0206.138] CloseHandle (hObject=0x15c) returned 1 [0206.138] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.png", lpFilePart=0x0) returned 0x60 [0206.138] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0206.138] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0206.138] GetFileType (hFile=0x15c) returned 0x1 [0206.138] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0206.138] GetFileType (hFile=0x15c) returned 0x1 [0206.138] WriteFile (in: hFile=0x15c, lpBuffer=0x22b3228*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22b3228*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0206.139] CloseHandle (hObject=0x15c) returned 1 [0206.139] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0206.139] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0206.139] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.140] GetFileType (hFile=0x15c) returned 0x1 [0206.140] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0206.140] GetFileType (hFile=0x15c) returned 0x1 [0206.140] WriteFile (in: hFile=0x15c, lpBuffer=0x22b6e88*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22b6e88*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0206.140] CloseHandle (hObject=0x15c) returned 1 [0206.141] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0206.141] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0206.141] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{113527a4-45d4-4b6f-b567-97838f1b04b0}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.141] GetFileType (hFile=0x15c) returned 0x1 [0206.141] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0206.141] GetFileType (hFile=0x15c) returned 0x1 [0206.141] WriteFile (in: hFile=0x15c, lpBuffer=0x22b9918*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22b9918*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0206.142] CloseHandle (hObject=0x15c) returned 1 [0206.142] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0206.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0206.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58 [0206.142] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0206.142] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.142] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.142] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.143] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0206.143] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0206.143] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0206.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0206.143] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}", lpFilePart=0x0) returned 0x57 [0206.143] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\", lpFilePart=0x0) returned 0x58 [0206.143] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.144] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.145] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0206.145] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0206.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0206.145] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", lpFilePart=0x0) returned 0x66 [0206.145] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\background.png", dwFileAttributes=0x80) returned 0 [0206.149] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.TXT", lpFilePart=0x0) returned 0x60 [0206.149] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0206.149] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.149] GetFileType (hFile=0x15c) returned 0x1 [0206.149] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0206.149] GetFileType (hFile=0x15c) returned 0x1 [0206.150] WriteFile (in: hFile=0x15c, lpBuffer=0x22c8b90*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22c8b90*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0206.150] CloseHandle (hObject=0x15c) returned 1 [0206.151] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.png", lpFilePart=0x0) returned 0x60 [0206.151] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0206.151] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0206.151] GetFileType (hFile=0x15c) returned 0x1 [0206.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0206.151] GetFileType (hFile=0x15c) returned 0x1 [0206.151] WriteFile (in: hFile=0x15c, lpBuffer=0x22c9c88*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22c9c88*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0206.152] CloseHandle (hObject=0x15c) returned 1 [0206.152] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.vbs", lpFilePart=0x0) returned 0x60 [0206.152] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0206.152] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.152] GetFileType (hFile=0x15c) returned 0x1 [0206.152] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0206.167] GetFileType (hFile=0x15c) returned 0x1 [0206.167] WriteFile (in: hFile=0x15c, lpBuffer=0x22cd8e8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22cd8e8*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0206.168] CloseHandle (hObject=0x15c) returned 1 [0206.169] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8c [0206.169] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0206.169] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\{8702d817-5aad-4674-9ef3-4d3decd87120}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.169] GetFileType (hFile=0x15c) returned 0x1 [0206.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0206.169] GetFileType (hFile=0x15c) returned 0x1 [0206.169] WriteFile (in: hFile=0x15c, lpBuffer=0x22d0378*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22d0378*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0206.170] CloseHandle (hObject=0x15c) returned 1 [0206.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0206.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0206.172] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.173] GetFileType (hFile=0x15c) returned 0x1 [0206.173] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0206.173] GetFileType (hFile=0x15c) returned 0x1 [0206.173] WriteFile (in: hFile=0x15c, lpBuffer=0x22da650*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x22da650*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0206.174] CloseHandle (hObject=0x15c) returned 1 [0206.174] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png", lpFilePart=0x0) returned 0x39 [0206.174] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0206.174] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0206.175] GetFileType (hFile=0x15c) returned 0x1 [0206.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0206.175] GetFileType (hFile=0x15c) returned 0x1 [0206.175] WriteFile (in: hFile=0x15c, lpBuffer=0x22db6f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22db6f8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0206.176] CloseHandle (hObject=0x15c) returned 1 [0206.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0206.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0206.176] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.177] GetFileType (hFile=0x15c) returned 0x1 [0206.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0206.177] GetFileType (hFile=0x15c) returned 0x1 [0206.177] WriteFile (in: hFile=0x15c, lpBuffer=0x22df268*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x22df268*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0206.178] CloseHandle (hObject=0x15c) returned 1 [0206.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0206.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0206.178] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Device\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\device\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0206.178] GetFileType (hFile=0x15c) returned 0x1 [0206.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0206.178] GetFileType (hFile=0x15c) returned 0x1 [0206.178] WriteFile (in: hFile=0x15c, lpBuffer=0x22e1c58*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x22e1c58*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0206.179] CloseHandle (hObject=0x15c) returned 1 [0206.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0206.180] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0206.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f [0206.181] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0206.182] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0206.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0206.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0206.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task", lpFilePart=0x0) returned 0x2e [0206.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\", lpFilePart=0x0) returned 0x2f [0206.182] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0206.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.183] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.183] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.183] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.183] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0206.183] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0206.183] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0206.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0206.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", lpFilePart=0x0) returned 0x37 [0206.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", dwFileAttributes=0x80) returned 1 [0206.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3f [0206.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0206.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0206.185] GetFileType (hFile=0x15c) returned 0x1 [0206.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0206.185] GetFileType (hFile=0x15c) returned 0x1 [0206.744] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", lpFilePart=0x0) returned 0x37 [0206.744] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0206.745] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0206.745] GetFileType (hFile=0x23c) returned 0x1 [0206.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0206.745] GetFileType (hFile=0x23c) returned 0x1 [0206.745] ReadFile (in: hFile=0x23c, lpBuffer=0x23ce470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23ce470*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0206.750] ReadFile (in: hFile=0x23c, lpBuffer=0x23ce470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23ce470*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0206.750] ReadFile (in: hFile=0x23c, lpBuffer=0x23ce470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23ce470*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0206.750] ReadFile (in: hFile=0x23c, lpBuffer=0x23ce470, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23ce470*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0206.750] CloseHandle (hObject=0x23c) returned 1 [0206.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", lpFilePart=0x0) returned 0x37 [0206.751] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.png")) returned 1 [0206.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0206.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0206.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56 [0206.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0206.752] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.752] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.752] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.753] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.754] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.754] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0206.754] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0206.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0206.754] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0206.754] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}", lpFilePart=0x0) returned 0x55 [0206.754] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\", lpFilePart=0x0) returned 0x56 [0206.754] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0206.754] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.754] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.754] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.755] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.756] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0206.756] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0206.756] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0206.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0206.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0206.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", lpFilePart=0x0) returned 0x5e [0206.756] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", dwFileAttributes=0x80) returned 1 [0206.757] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x66 [0206.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0206.757] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0206.757] GetFileType (hFile=0x15c) returned 0x1 [0206.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0206.757] GetFileType (hFile=0x15c) returned 0x1 [0207.262] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", lpFilePart=0x0) returned 0x5e [0207.262] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0207.262] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0207.262] GetFileType (hFile=0x23c) returned 0x1 [0207.262] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0207.262] GetFileType (hFile=0x23c) returned 0x1 [0207.263] ReadFile (in: hFile=0x23c, lpBuffer=0x22c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22c0d18*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0207.267] ReadFile (in: hFile=0x23c, lpBuffer=0x22c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22c0d18*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0207.268] ReadFile (in: hFile=0x23c, lpBuffer=0x22c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22c0d18*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0207.268] ReadFile (in: hFile=0x23c, lpBuffer=0x22c0d18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22c0d18*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0207.268] CloseHandle (hObject=0x23c) returned 1 [0207.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", lpFilePart=0x0) returned 0x5e [0207.268] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.png")) returned 1 [0207.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", lpFilePart=0x0) returned 0x62 [0207.269] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\resource.xml", dwFileAttributes=0x80) returned 0 [0207.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.TXT", lpFilePart=0x0) returned 0x5e [0207.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0207.273] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0207.273] GetFileType (hFile=0x15c) returned 0x1 [0207.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0207.273] GetFileType (hFile=0x15c) returned 0x1 [0207.273] WriteFile (in: hFile=0x15c, lpBuffer=0x22cdd88*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22cdd88*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0207.274] CloseHandle (hObject=0x15c) returned 1 [0207.274] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png", lpFilePart=0x0) returned 0x5e [0207.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0207.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0207.275] GetFileType (hFile=0x15c) returned 0x1 [0207.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0207.275] GetFileType (hFile=0x15c) returned 0x1 [0207.275] WriteFile (in: hFile=0x15c, lpBuffer=0x22cee78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22cee78*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0207.276] CloseHandle (hObject=0x15c) returned 1 [0207.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.vbs", lpFilePart=0x0) returned 0x5e [0207.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0207.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0207.276] GetFileType (hFile=0x15c) returned 0x1 [0207.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0207.276] GetFileType (hFile=0x15c) returned 0x1 [0207.276] WriteFile (in: hFile=0x15c, lpBuffer=0x22d2ac0*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x22d2ac0*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0207.277] CloseHandle (hObject=0x15c) returned 1 [0207.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8a [0207.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0207.277] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0207.277] GetFileType (hFile=0x15c) returned 0x1 [0207.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0207.277] GetFileType (hFile=0x15c) returned 0x1 [0207.278] WriteFile (in: hFile=0x15c, lpBuffer=0x22d5540*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x22d5540*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0207.278] CloseHandle (hObject=0x15c) returned 1 [0207.278] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0207.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0207.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56 [0207.279] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.279] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.280] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0207.280] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0207.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0207.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0207.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0207.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}", lpFilePart=0x0) returned 0x55 [0207.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\", lpFilePart=0x0) returned 0x56 [0207.281] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.281] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0207.282] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0207.282] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0207.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0207.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0207.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", lpFilePart=0x0) returned 0x5e [0207.283] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", dwFileAttributes=0x80) returned 1 [0207.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x66 [0207.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0207.283] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0207.284] GetFileType (hFile=0x15c) returned 0x1 [0207.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0207.284] GetFileType (hFile=0x15c) returned 0x1 [0208.003] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", lpFilePart=0x0) returned 0x5e [0208.003] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0208.003] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0208.003] GetFileType (hFile=0x23c) returned 0x1 [0208.003] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0208.003] GetFileType (hFile=0x23c) returned 0x1 [0208.003] ReadFile (in: hFile=0x23c, lpBuffer=0x23c5410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23c5410*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0208.008] ReadFile (in: hFile=0x23c, lpBuffer=0x23c5410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23c5410*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0208.009] ReadFile (in: hFile=0x23c, lpBuffer=0x23c5410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23c5410*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0208.009] ReadFile (in: hFile=0x23c, lpBuffer=0x23c5410, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23c5410*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0208.009] CloseHandle (hObject=0x23c) returned 1 [0208.009] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", lpFilePart=0x0) returned 0x5e [0208.009] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.png")) returned 1 [0208.010] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", lpFilePart=0x0) returned 0x5f [0208.010] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\tasks.xml", dwFileAttributes=0x80) returned 0 [0208.014] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.TXT", lpFilePart=0x0) returned 0x5e [0208.014] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0208.014] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.014] GetFileType (hFile=0x15c) returned 0x1 [0208.014] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0208.014] GetFileType (hFile=0x15c) returned 0x1 [0208.015] WriteFile (in: hFile=0x15c, lpBuffer=0x23d2510*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x23d2510*, lpNumberOfBytesWritten=0x2edcf8*=0x39b, lpOverlapped=0x0) returned 1 [0208.016] CloseHandle (hObject=0x15c) returned 1 [0208.016] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png", lpFilePart=0x0) returned 0x5e [0208.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0208.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0208.016] GetFileType (hFile=0x15c) returned 0x1 [0208.016] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0208.016] GetFileType (hFile=0x15c) returned 0x1 [0208.016] WriteFile (in: hFile=0x15c, lpBuffer=0x23d3600*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23d3600*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0208.017] CloseHandle (hObject=0x15c) returned 1 [0208.017] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.vbs", lpFilePart=0x0) returned 0x5e [0208.017] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0208.017] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.017] GetFileType (hFile=0x15c) returned 0x1 [0208.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0208.017] GetFileType (hFile=0x15c) returned 0x1 [0208.018] WriteFile (in: hFile=0x15c, lpBuffer=0x23d7248*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edc98, lpOverlapped=0x0 | out: lpBuffer=0x23d7248*, lpNumberOfBytesWritten=0x2edc98*=0x13c, lpOverlapped=0x0) returned 1 [0208.018] CloseHandle (hObject=0x15c) returned 1 [0208.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8a [0208.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0208.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.019] GetFileType (hFile=0x15c) returned 0x1 [0208.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0208.019] GetFileType (hFile=0x15c) returned 0x1 [0208.019] WriteFile (in: hFile=0x15c, lpBuffer=0x23d9cc8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edcf8, lpOverlapped=0x0 | out: lpBuffer=0x23d9cc8*, lpNumberOfBytesWritten=0x2edcf8*=0xc6, lpOverlapped=0x0) returned 1 [0208.020] CloseHandle (hObject=0x15c) returned 1 [0208.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0208.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0208.021] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.022] GetFileType (hFile=0x15c) returned 0x1 [0208.022] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0208.022] GetFileType (hFile=0x15c) returned 0x1 [0208.022] WriteFile (in: hFile=0x15c, lpBuffer=0x23e3f90*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23e3f90*, lpNumberOfBytesWritten=0x2edd78*=0x39b, lpOverlapped=0x0) returned 1 [0208.023] CloseHandle (hObject=0x15c) returned 1 [0208.023] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png", lpFilePart=0x0) returned 0x37 [0208.023] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0208.023] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0208.023] GetFileType (hFile=0x15c) returned 0x1 [0208.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0208.023] GetFileType (hFile=0x15c) returned 0x1 [0208.023] WriteFile (in: hFile=0x15c, lpBuffer=0x23e5030*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23e5030*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0208.025] CloseHandle (hObject=0x15c) returned 1 [0208.025] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0208.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0208.025] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.025] GetFileType (hFile=0x15c) returned 0x1 [0208.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0208.025] GetFileType (hFile=0x15c) returned 0x1 [0208.025] WriteFile (in: hFile=0x15c, lpBuffer=0x23e8b88*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd18, lpOverlapped=0x0 | out: lpBuffer=0x23e8b88*, lpNumberOfBytesWritten=0x2edd18*=0x13c, lpOverlapped=0x0) returned 1 [0208.026] CloseHandle (hObject=0x15c) returned 1 [0208.026] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0208.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0208.026] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Task\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\task\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.027] GetFileType (hFile=0x15c) returned 0x1 [0208.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0208.027] GetFileType (hFile=0x15c) returned 0x1 [0208.027] WriteFile (in: hFile=0x15c, lpBuffer=0x23eb568*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2edd78, lpOverlapped=0x0 | out: lpBuffer=0x23eb568*, lpNumberOfBytesWritten=0x2edd78*=0xc6, lpOverlapped=0x0) returned 1 [0208.028] CloseHandle (hObject=0x15c) returned 1 [0208.028] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0208.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0208.028] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.028] GetFileType (hFile=0x15c) returned 0x1 [0208.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0208.028] GetFileType (hFile=0x15c) returned 0x1 [0208.028] WriteFile (in: hFile=0x15c, lpBuffer=0x23f5820*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23f5820*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0208.029] CloseHandle (hObject=0x15c) returned 1 [0208.029] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png", lpFilePart=0x0) returned 0x32 [0208.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0208.029] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0208.030] GetFileType (hFile=0x15c) returned 0x1 [0208.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0208.030] GetFileType (hFile=0x15c) returned 0x1 [0208.030] WriteFile (in: hFile=0x15c, lpBuffer=0x23f68b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23f68b8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0208.031] CloseHandle (hObject=0x15c) returned 1 [0208.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0208.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0208.031] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\device stage\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.031] GetFileType (hFile=0x15c) returned 0x1 [0208.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0208.031] GetFileType (hFile=0x15c) returned 0x1 [0208.031] WriteFile (in: hFile=0x15c, lpBuffer=0x23fa3f8*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x23fa3f8*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0208.032] CloseHandle (hObject=0x15c) returned 1 [0208.032] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Device Stage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0208.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0208.032] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Device Stage\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\device stage\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.032] GetFileType (hFile=0x15c) returned 0x1 [0208.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0208.032] GetFileType (hFile=0x15c) returned 0x1 [0208.032] WriteFile (in: hFile=0x15c, lpBuffer=0x23fcdc8*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23fcdc8*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0208.033] CloseHandle (hObject=0x15c) returned 1 [0208.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0208.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0208.034] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28 [0208.034] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0208.034] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.034] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.034] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.034] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.034] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.034] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0208.034] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0208.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0208.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0208.035] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0208.035] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync", lpFilePart=0x0) returned 0x27 [0208.035] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\", lpFilePart=0x0) returned 0x28 [0208.035] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0208.035] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.035] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.035] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.035] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.035] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.035] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0208.036] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0208.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0208.036] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0208.036] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", lpFilePart=0x0) returned 0x30 [0208.036] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", dwFileAttributes=0x80) returned 1 [0208.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x38 [0208.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0208.037] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0208.037] GetFileType (hFile=0x15c) returned 0x1 [0208.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0208.037] GetFileType (hFile=0x15c) returned 0x1 [0208.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", lpFilePart=0x0) returned 0x30 [0208.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0208.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0208.608] GetFileType (hFile=0x23c) returned 0x1 [0208.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0208.608] GetFileType (hFile=0x23c) returned 0x1 [0208.608] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22e8848*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0208.614] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22e8848*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0208.614] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22e8848*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0208.614] ReadFile (in: hFile=0x23c, lpBuffer=0x22e8848, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22e8848*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0208.614] CloseHandle (hObject=0x23c) returned 1 [0208.614] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", lpFilePart=0x0) returned 0x30 [0208.614] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.png")) returned 1 [0208.618] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0208.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0208.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.618] GetFileType (hFile=0x15c) returned 0x1 [0208.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0208.618] GetFileType (hFile=0x15c) returned 0x1 [0208.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png", lpFilePart=0x0) returned 0x30 [0208.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0208.619] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0208.620] GetFileType (hFile=0x15c) returned 0x1 [0208.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0208.620] GetFileType (hFile=0x15c) returned 0x1 [0208.620] WriteFile (in: hFile=0x15c, lpBuffer=0x22f6120*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22f6120*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0208.621] CloseHandle (hObject=0x15c) returned 1 [0208.621] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0208.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0208.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.621] GetFileType (hFile=0x15c) returned 0x1 [0208.621] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0208.621] GetFileType (hFile=0x15c) returned 0x1 [0208.622] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DeviceSync\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0208.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0208.622] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DeviceSync\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\devicesync\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0208.622] GetFileType (hFile=0x15c) returned 0x1 [0208.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0208.622] GetFileType (hFile=0x15c) returned 0x1 [0208.623] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0208.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20 [0208.623] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21 [0208.623] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0208.623] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.623] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.623] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.624] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.624] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.624] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.624] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0208.624] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0208.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0208.624] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0208.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0208.624] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM", lpFilePart=0x0) returned 0x20 [0208.624] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\", lpFilePart=0x0) returned 0x21 [0208.624] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0208.624] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.625] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.625] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.625] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.625] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.625] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0208.625] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0208.625] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0208.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0208.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0208.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", lpFilePart=0x0) returned 0x29 [0208.625] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", dwFileAttributes=0x80) returned 1 [0208.626] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x31 [0208.626] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0208.626] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0208.627] GetFileType (hFile=0x15c) returned 0x1 [0208.627] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0208.627] GetFileType (hFile=0x15c) returned 0x1 [0209.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", lpFilePart=0x0) returned 0x29 [0209.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0209.194] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0209.195] GetFileType (hFile=0x23c) returned 0x1 [0209.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0209.195] GetFileType (hFile=0x23c) returned 0x1 [0209.195] ReadFile (in: hFile=0x23c, lpBuffer=0x23e8050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e8050*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0209.201] ReadFile (in: hFile=0x23c, lpBuffer=0x23e8050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e8050*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0209.202] ReadFile (in: hFile=0x23c, lpBuffer=0x23e8050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e8050*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0209.202] ReadFile (in: hFile=0x23c, lpBuffer=0x23e8050, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e8050*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0209.202] CloseHandle (hObject=0x23c) returned 1 [0209.202] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", lpFilePart=0x0) returned 0x29 [0209.202] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.png")) returned 1 [0209.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0209.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27 [0209.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28 [0209.204] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0209.204] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.204] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.205] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.205] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.205] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.205] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0209.205] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0209.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0209.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0209.205] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0209.205] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server", lpFilePart=0x0) returned 0x27 [0209.205] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\", lpFilePart=0x0) returned 0x28 [0209.205] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0209.206] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.206] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.206] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.206] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.206] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0209.206] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0209.207] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0209.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0209.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0209.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", lpFilePart=0x0) returned 0x30 [0209.207] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", dwFileAttributes=0x80) returned 1 [0209.208] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x38 [0209.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0209.208] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0209.246] GetFileType (hFile=0x15c) returned 0x1 [0209.246] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0209.246] GetFileType (hFile=0x15c) returned 0x1 [0210.155] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", lpFilePart=0x0) returned 0x30 [0210.155] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0210.155] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0210.156] GetFileType (hFile=0x23c) returned 0x1 [0210.156] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0210.156] GetFileType (hFile=0x23c) returned 0x1 [0210.156] ReadFile (in: hFile=0x23c, lpBuffer=0x22d6060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d6060*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0210.161] ReadFile (in: hFile=0x23c, lpBuffer=0x22d6060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d6060*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0210.161] ReadFile (in: hFile=0x23c, lpBuffer=0x22d6060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d6060*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0210.161] ReadFile (in: hFile=0x23c, lpBuffer=0x22d6060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d6060*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0210.162] CloseHandle (hObject=0x23c) returned 1 [0210.163] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", lpFilePart=0x0) returned 0x30 [0210.163] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.png")) returned 1 [0210.167] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0210.167] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0210.167] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0210.167] GetFileType (hFile=0x15c) returned 0x1 [0210.167] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0210.167] GetFileType (hFile=0x15c) returned 0x1 [0210.168] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png", lpFilePart=0x0) returned 0x30 [0210.168] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0210.168] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0210.169] GetFileType (hFile=0x15c) returned 0x1 [0210.169] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0210.169] GetFileType (hFile=0x15c) returned 0x1 [0210.169] WriteFile (in: hFile=0x15c, lpBuffer=0x22e3938*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22e3938*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0210.170] CloseHandle (hObject=0x15c) returned 1 [0210.170] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0210.170] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0210.170] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0210.171] GetFileType (hFile=0x15c) returned 0x1 [0210.171] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0210.171] GetFileType (hFile=0x15c) returned 0x1 [0210.172] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0210.172] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0210.172] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Server\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\drm\\server\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0210.172] GetFileType (hFile=0x15c) returned 0x1 [0210.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0210.172] GetFileType (hFile=0x15c) returned 0x1 [0210.173] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.TXT", lpFilePart=0x0) returned 0x29 [0210.173] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0210.173] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0210.174] GetFileType (hFile=0x15c) returned 0x1 [0210.174] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0210.174] GetFileType (hFile=0x15c) returned 0x1 [0210.175] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png", lpFilePart=0x0) returned 0x29 [0210.175] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0210.175] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0210.175] GetFileType (hFile=0x15c) returned 0x1 [0210.175] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0210.175] GetFileType (hFile=0x15c) returned 0x1 [0210.175] WriteFile (in: hFile=0x15c, lpBuffer=0x22f5168*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22f5168*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0210.176] CloseHandle (hObject=0x15c) returned 1 [0210.176] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.vbs", lpFilePart=0x0) returned 0x29 [0210.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0210.177] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\drm\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0210.177] GetFileType (hFile=0x15c) returned 0x1 [0210.177] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0210.177] GetFileType (hFile=0x15c) returned 0x1 [0210.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\DRM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x55 [0210.178] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0210.178] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\DRM\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\drm\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0210.178] GetFileType (hFile=0x15c) returned 0x1 [0210.178] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0210.178] GetFileType (hFile=0x15c) returned 0x1 [0210.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0210.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22 [0210.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23 [0210.179] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0210.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.180] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0210.181] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0210.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0210.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0210.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0210.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome", lpFilePart=0x0) returned 0x22 [0210.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\", lpFilePart=0x0) returned 0x23 [0210.181] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0210.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.181] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0210.182] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0210.182] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0210.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0210.182] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0210.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", lpFilePart=0x0) returned 0x2b [0210.183] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", dwFileAttributes=0x80) returned 1 [0210.184] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x33 [0210.184] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0210.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0210.184] GetFileType (hFile=0x15c) returned 0x1 [0210.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0210.184] GetFileType (hFile=0x15c) returned 0x1 [0210.748] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", lpFilePart=0x0) returned 0x2b [0210.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0210.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0210.749] GetFileType (hFile=0x23c) returned 0x1 [0210.749] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0210.749] GetFileType (hFile=0x23c) returned 0x1 [0210.749] ReadFile (in: hFile=0x23c, lpBuffer=0x23e70b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e70b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0210.754] ReadFile (in: hFile=0x23c, lpBuffer=0x23e70b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e70b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0210.754] ReadFile (in: hFile=0x23c, lpBuffer=0x23e70b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e70b8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0210.754] ReadFile (in: hFile=0x23c, lpBuffer=0x23e70b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e70b8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0210.755] CloseHandle (hObject=0x23c) returned 1 [0210.755] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", lpFilePart=0x0) returned 0x2b [0210.755] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.png")) returned 1 [0210.756] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0210.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27 [0210.756] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28 [0210.756] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0210.756] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.756] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.757] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.757] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.757] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.757] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0210.757] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0210.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0210.757] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0210.757] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0210.757] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs", lpFilePart=0x0) returned 0x27 [0210.757] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\", lpFilePart=0x0) returned 0x28 [0210.757] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0210.757] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.757] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.758] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.758] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.758] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0210.758] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0210.758] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0210.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0210.758] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0210.758] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", lpFilePart=0x0) returned 0x30 [0210.758] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", dwFileAttributes=0x80) returned 1 [0210.759] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x38 [0210.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0210.759] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0210.761] GetFileType (hFile=0x15c) returned 0x1 [0210.761] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0210.761] GetFileType (hFile=0x15c) returned 0x1 [0211.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", lpFilePart=0x0) returned 0x30 [0211.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0211.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0211.274] GetFileType (hFile=0x23c) returned 0x1 [0211.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0211.274] GetFileType (hFile=0x23c) returned 0x1 [0211.274] ReadFile (in: hFile=0x23c, lpBuffer=0x22d4930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d4930*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0211.276] ReadFile (in: hFile=0x23c, lpBuffer=0x22d4930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d4930*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0211.279] ReadFile (in: hFile=0x23c, lpBuffer=0x22d4930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d4930*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0211.279] ReadFile (in: hFile=0x23c, lpBuffer=0x22d4930, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d4930*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0211.279] CloseHandle (hObject=0x23c) returned 1 [0211.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", lpFilePart=0x0) returned 0x30 [0211.280] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.png")) returned 1 [0211.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.TXT", lpFilePart=0x0) returned 0x30 [0211.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0211.282] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0211.289] GetFileType (hFile=0x15c) returned 0x1 [0211.289] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0211.289] GetFileType (hFile=0x15c) returned 0x1 [0211.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png", lpFilePart=0x0) returned 0x30 [0211.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0211.290] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0211.290] GetFileType (hFile=0x15c) returned 0x1 [0211.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0211.291] GetFileType (hFile=0x15c) returned 0x1 [0211.291] WriteFile (in: hFile=0x15c, lpBuffer=0x22e2208*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22e2208*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0211.292] CloseHandle (hObject=0x15c) returned 1 [0211.292] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.vbs", lpFilePart=0x0) returned 0x30 [0211.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0211.292] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0211.292] GetFileType (hFile=0x15c) returned 0x1 [0211.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0211.292] GetFileType (hFile=0x15c) returned 0x1 [0211.293] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5c [0211.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0211.293] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\ehome\\logs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0211.293] GetFileType (hFile=0x15c) returned 0x1 [0211.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0211.293] GetFileType (hFile=0x15c) returned 0x1 [0211.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.TXT", lpFilePart=0x0) returned 0x2b [0211.294] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0211.294] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0211.294] GetFileType (hFile=0x15c) returned 0x1 [0211.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0211.295] GetFileType (hFile=0x15c) returned 0x1 [0211.295] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png", lpFilePart=0x0) returned 0x2b [0211.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0211.295] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0211.296] GetFileType (hFile=0x15c) returned 0x1 [0211.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0211.296] GetFileType (hFile=0x15c) returned 0x1 [0211.296] WriteFile (in: hFile=0x15c, lpBuffer=0x22f3a38*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22f3a38*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0211.297] CloseHandle (hObject=0x15c) returned 1 [0211.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.vbs", lpFilePart=0x0) returned 0x2b [0211.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0211.297] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\ehome\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0211.297] GetFileType (hFile=0x15c) returned 0x1 [0211.297] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0211.297] GetFileType (hFile=0x15c) returned 0x1 [0211.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\eHome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x57 [0211.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0211.298] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\eHome\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\ehome\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0211.298] GetFileType (hFile=0x15c) returned 0x1 [0211.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0211.298] GetFileType (hFile=0x15c) returned 0x1 [0211.299] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0211.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29 [0211.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a [0211.299] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0211.299] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.300] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.300] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.300] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.300] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.300] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.300] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0211.300] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0211.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0211.300] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0211.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0211.300] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer", lpFilePart=0x0) returned 0x29 [0211.300] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\", lpFilePart=0x0) returned 0x2a [0211.300] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0211.301] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0211.302] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0211.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0211.302] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0211.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", lpFilePart=0x0) returned 0x32 [0211.302] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", dwFileAttributes=0x80) returned 1 [0211.302] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3a [0211.303] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0211.303] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0211.303] GetFileType (hFile=0x15c) returned 0x1 [0211.303] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0211.303] GetFileType (hFile=0x15c) returned 0x1 [0211.797] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", lpFilePart=0x0) returned 0x32 [0211.797] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0211.797] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0211.798] GetFileType (hFile=0x23c) returned 0x1 [0211.798] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0211.798] GetFileType (hFile=0x23c) returned 0x1 [0211.798] ReadFile (in: hFile=0x23c, lpBuffer=0x23e5398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e5398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0211.803] ReadFile (in: hFile=0x23c, lpBuffer=0x23e5398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e5398*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0211.803] ReadFile (in: hFile=0x23c, lpBuffer=0x23e5398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e5398*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0211.803] ReadFile (in: hFile=0x23c, lpBuffer=0x23e5398, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23e5398*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0211.803] CloseHandle (hObject=0x23c) returned 1 [0211.803] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", lpFilePart=0x0) returned 0x32 [0211.803] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.png")) returned 1 [0211.805] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0211.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f [0211.805] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30 [0211.805] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0211.808] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.808] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.808] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.808] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.809] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.809] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.809] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0211.809] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0211.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0211.809] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0211.809] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0211.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views", lpFilePart=0x0) returned 0x2f [0211.809] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\", lpFilePart=0x0) returned 0x30 [0211.809] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x4cf960 [0211.809] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.809] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.810] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.810] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.810] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.810] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0211.810] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0211.810] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0211.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0211.810] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0211.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", lpFilePart=0x0) returned 0x38 [0211.810] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", dwFileAttributes=0x80) returned 1 [0211.811] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x40 [0211.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0211.811] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0211.812] GetFileType (hFile=0x15c) returned 0x1 [0211.812] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0211.812] GetFileType (hFile=0x15c) returned 0x1 [0212.489] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", lpFilePart=0x0) returned 0x38 [0212.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0212.489] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0212.489] GetFileType (hFile=0x23c) returned 0x1 [0212.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0212.489] GetFileType (hFile=0x23c) returned 0x1 [0212.489] ReadFile (in: hFile=0x23c, lpBuffer=0x22d13b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d13b8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0212.495] ReadFile (in: hFile=0x23c, lpBuffer=0x22d13b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d13b8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0212.495] ReadFile (in: hFile=0x23c, lpBuffer=0x22d13b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d13b8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0212.495] ReadFile (in: hFile=0x23c, lpBuffer=0x22d13b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22d13b8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0212.495] CloseHandle (hObject=0x23c) returned 1 [0212.495] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", lpFilePart=0x0) returned 0x38 [0212.495] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.png")) returned 1 [0212.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0212.497] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48 [0212.497] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49 [0212.497] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0212.497] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.497] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.497] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.498] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.498] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.498] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0212.498] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0212.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0212.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0212.498] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0212.498] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode", lpFilePart=0x0) returned 0x48 [0212.498] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\", lpFilePart=0x0) returned 0x49 [0212.498] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x4cf960 [0212.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0212.499] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0212.500] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0212.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0212.500] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0212.500] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", lpFilePart=0x0) returned 0x51 [0212.500] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", dwFileAttributes=0x80) returned 1 [0212.501] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x59 [0212.501] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0212.501] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0212.501] GetFileType (hFile=0x15c) returned 0x1 [0212.501] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0212.501] GetFileType (hFile=0x15c) returned 0x1 [0213.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", lpFilePart=0x0) returned 0x51 [0213.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0213.031] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0213.031] GetFileType (hFile=0x23c) returned 0x1 [0213.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0213.031] GetFileType (hFile=0x23c) returned 0x1 [0213.031] ReadFile (in: hFile=0x23c, lpBuffer=0x23bd800, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23bd800*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0213.037] ReadFile (in: hFile=0x23c, lpBuffer=0x23bd800, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23bd800*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0213.038] ReadFile (in: hFile=0x23c, lpBuffer=0x23bd800, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23bd800*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0213.038] ReadFile (in: hFile=0x23c, lpBuffer=0x23bd800, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23bd800*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0213.038] CloseHandle (hObject=0x23c) returned 1 [0213.038] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", lpFilePart=0x0) returned 0x51 [0213.038] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.png")) returned 1 [0213.041] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.TXT", lpFilePart=0x0) returned 0x51 [0213.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0213.041] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.042] GetFileType (hFile=0x15c) returned 0x1 [0213.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0213.042] GetFileType (hFile=0x15c) returned 0x1 [0213.043] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png", lpFilePart=0x0) returned 0x51 [0213.043] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0213.043] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0213.043] GetFileType (hFile=0x15c) returned 0x1 [0213.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0213.043] GetFileType (hFile=0x15c) returned 0x1 [0213.044] WriteFile (in: hFile=0x15c, lpBuffer=0x23cb1d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23cb1d8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0213.044] CloseHandle (hObject=0x15c) returned 1 [0213.045] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.vbs", lpFilePart=0x0) returned 0x51 [0213.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0213.045] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.045] GetFileType (hFile=0x15c) returned 0x1 [0213.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0213.045] GetFileType (hFile=0x15c) returned 0x1 [0213.046] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7d [0213.046] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0213.046] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\ApplicationViewsRootNode\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\applicationviewsrootnode\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.046] GetFileType (hFile=0x15c) returned 0x1 [0213.046] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0213.046] GetFileType (hFile=0x15c) returned 0x1 [0213.047] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0213.047] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0213.047] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.047] GetFileType (hFile=0x15c) returned 0x1 [0213.047] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0213.047] GetFileType (hFile=0x15c) returned 0x1 [0213.048] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png", lpFilePart=0x0) returned 0x38 [0213.048] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0213.048] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0213.048] GetFileType (hFile=0x15c) returned 0x1 [0213.048] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0213.049] GetFileType (hFile=0x15c) returned 0x1 [0213.049] WriteFile (in: hFile=0x15c, lpBuffer=0x23dcba8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23dcba8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0213.049] CloseHandle (hObject=0x15c) returned 1 [0213.050] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0213.050] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0213.050] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.050] GetFileType (hFile=0x15c) returned 0x1 [0213.050] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0213.050] GetFileType (hFile=0x15c) returned 0x1 [0213.051] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0213.051] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0213.051] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Views\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\views\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.051] GetFileType (hFile=0x15c) returned 0x1 [0213.051] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0213.051] GetFileType (hFile=0x15c) returned 0x1 [0213.052] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0213.052] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0213.052] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.052] GetFileType (hFile=0x15c) returned 0x1 [0213.052] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0213.052] GetFileType (hFile=0x15c) returned 0x1 [0213.053] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png", lpFilePart=0x0) returned 0x32 [0213.053] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0213.053] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0213.054] GetFileType (hFile=0x15c) returned 0x1 [0213.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0213.054] GetFileType (hFile=0x15c) returned 0x1 [0213.054] WriteFile (in: hFile=0x15c, lpBuffer=0x23ee458*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23ee458*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0213.056] CloseHandle (hObject=0x15c) returned 1 [0213.056] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0213.056] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0213.056] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.056] GetFileType (hFile=0x15c) returned 0x1 [0213.056] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0213.056] GetFileType (hFile=0x15c) returned 0x1 [0213.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0213.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0213.057] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Event Viewer\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\event viewer\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.057] GetFileType (hFile=0x15c) returned 0x1 [0213.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0213.057] GetFileType (hFile=0x15c) returned 0x1 [0213.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0213.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28 [0213.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29 [0213.058] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0213.058] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.059] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0213.059] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0213.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0213.059] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0213.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0213.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL", lpFilePart=0x0) returned 0x28 [0213.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\", lpFilePart=0x0) returned 0x29 [0213.059] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.060] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.061] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0213.061] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0213.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0213.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0213.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", lpFilePart=0x0) returned 0x31 [0213.061] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", dwFileAttributes=0x80) returned 1 [0213.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x39 [0213.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0213.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0213.062] GetFileType (hFile=0x15c) returned 0x1 [0213.062] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0213.062] GetFileType (hFile=0x15c) returned 0x1 [0213.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", lpFilePart=0x0) returned 0x31 [0213.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0213.582] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0213.582] GetFileType (hFile=0x23c) returned 0x1 [0213.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0213.582] GetFileType (hFile=0x23c) returned 0x1 [0213.582] ReadFile (in: hFile=0x23c, lpBuffer=0x22bcb60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bcb60*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0213.586] ReadFile (in: hFile=0x23c, lpBuffer=0x22bcb60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bcb60*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0213.587] ReadFile (in: hFile=0x23c, lpBuffer=0x22bcb60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bcb60*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0213.587] ReadFile (in: hFile=0x23c, lpBuffer=0x22bcb60, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bcb60*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0213.588] CloseHandle (hObject=0x23c) returned 1 [0213.588] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", lpFilePart=0x0) returned 0x31 [0213.588] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.png")) returned 1 [0213.589] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.TXT", lpFilePart=0x0) returned 0x31 [0213.590] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0213.590] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.590] GetFileType (hFile=0x15c) returned 0x1 [0213.590] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0213.590] GetFileType (hFile=0x15c) returned 0x1 [0213.591] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png", lpFilePart=0x0) returned 0x31 [0213.591] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0213.591] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0213.592] GetFileType (hFile=0x15c) returned 0x1 [0213.592] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0213.592] GetFileType (hFile=0x15c) returned 0x1 [0213.592] WriteFile (in: hFile=0x15c, lpBuffer=0x22ca488*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22ca488*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0213.593] CloseHandle (hObject=0x15c) returned 1 [0213.593] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.vbs", lpFilePart=0x0) returned 0x31 [0213.593] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0213.593] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.593] GetFileType (hFile=0x15c) returned 0x1 [0213.593] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0213.593] GetFileType (hFile=0x15c) returned 0x1 [0213.595] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5d [0213.595] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0213.595] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\IdentityCRL\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\identitycrl\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0213.595] GetFileType (hFile=0x15c) returned 0x1 [0213.595] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0213.595] GetFileType (hFile=0x15c) returned 0x1 [0213.596] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0213.596] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29 [0213.596] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a [0213.596] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0213.597] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.597] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.597] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.597] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.597] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.597] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0213.597] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0213.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0213.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0213.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0213.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player", lpFilePart=0x0) returned 0x29 [0213.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\", lpFilePart=0x0) returned 0x2a [0213.598] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0213.598] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.598] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.598] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.599] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.599] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0213.599] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0213.599] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0213.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0213.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0213.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", lpFilePart=0x0) returned 0x32 [0213.599] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", dwFileAttributes=0x80) returned 1 [0213.600] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3a [0213.600] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0213.601] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0213.601] GetFileType (hFile=0x15c) returned 0x1 [0213.601] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0213.601] GetFileType (hFile=0x15c) returned 0x1 [0214.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", lpFilePart=0x0) returned 0x32 [0214.179] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0214.179] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0214.179] GetFileType (hFile=0x23c) returned 0x1 [0214.179] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0214.179] GetFileType (hFile=0x23c) returned 0x1 [0214.180] ReadFile (in: hFile=0x23c, lpBuffer=0x23bc3a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bc3a8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0214.184] ReadFile (in: hFile=0x23c, lpBuffer=0x23bc3a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bc3a8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0214.184] ReadFile (in: hFile=0x23c, lpBuffer=0x23bc3a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bc3a8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0214.185] ReadFile (in: hFile=0x23c, lpBuffer=0x23bc3a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bc3a8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0214.185] CloseHandle (hObject=0x23c) returned 1 [0214.185] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", lpFilePart=0x0) returned 0x32 [0214.185] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.png")) returned 1 [0214.188] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0214.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0214.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0214.188] GetFileType (hFile=0x15c) returned 0x1 [0214.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0214.188] GetFileType (hFile=0x15c) returned 0x1 [0214.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png", lpFilePart=0x0) returned 0x32 [0214.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0214.189] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0214.190] GetFileType (hFile=0x15c) returned 0x1 [0214.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0214.190] GetFileType (hFile=0x15c) returned 0x1 [0214.190] WriteFile (in: hFile=0x15c, lpBuffer=0x23c9c80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23c9c80*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0214.190] CloseHandle (hObject=0x15c) returned 1 [0214.191] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0214.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0214.191] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\media player\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0214.191] GetFileType (hFile=0x15c) returned 0x1 [0214.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0214.191] GetFileType (hFile=0x15c) returned 0x1 [0214.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0214.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0214.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Media Player\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\media player\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0214.192] GetFileType (hFile=0x15c) returned 0x1 [0214.192] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0214.192] GetFileType (hFile=0x15c) returned 0x1 [0214.193] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0214.193] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f [0214.193] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20 [0214.193] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0214.193] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.193] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.193] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.193] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0214.194] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0214.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0214.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0214.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0214.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF", lpFilePart=0x0) returned 0x1f [0214.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\", lpFilePart=0x0) returned 0x20 [0214.194] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0214.194] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.195] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0214.195] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0214.195] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0214.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0214.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", lpFilePart=0x0) returned 0x28 [0214.196] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", dwFileAttributes=0x80) returned 1 [0214.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x30 [0214.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0214.197] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0214.197] GetFileType (hFile=0x15c) returned 0x1 [0214.197] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0214.197] GetFileType (hFile=0x15c) returned 0x1 [0214.753] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", lpFilePart=0x0) returned 0x28 [0214.753] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0214.753] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0214.754] GetFileType (hFile=0x23c) returned 0x1 [0214.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0214.754] GetFileType (hFile=0x23c) returned 0x1 [0214.754] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbfd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbfd8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0214.757] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbfd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbfd8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0214.759] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbfd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbfd8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0214.759] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbfd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbfd8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0214.759] CloseHandle (hObject=0x23c) returned 1 [0214.760] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", lpFilePart=0x0) returned 0x28 [0214.760] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.png")) returned 1 [0214.761] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.TXT", lpFilePart=0x0) returned 0x28 [0214.761] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0214.761] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0214.762] GetFileType (hFile=0x15c) returned 0x1 [0214.762] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0214.762] GetFileType (hFile=0x15c) returned 0x1 [0214.762] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png", lpFilePart=0x0) returned 0x28 [0214.762] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0214.763] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0214.763] GetFileType (hFile=0x15c) returned 0x1 [0214.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0214.763] GetFileType (hFile=0x15c) returned 0x1 [0214.763] WriteFile (in: hFile=0x15c, lpBuffer=0x22c9898*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22c9898*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0214.764] CloseHandle (hObject=0x15c) returned 1 [0214.764] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\Hack.vbs", lpFilePart=0x0) returned 0x28 [0214.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0214.764] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\mf\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0214.764] GetFileType (hFile=0x15c) returned 0x1 [0214.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0214.764] GetFileType (hFile=0x15c) returned 0x1 [0214.765] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MF\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x54 [0214.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0214.765] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MF\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\mf\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0214.766] GetFileType (hFile=0x15c) returned 0x1 [0214.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0214.766] GetFileType (hFile=0x15c) returned 0x1 [0214.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0214.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21 [0214.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22 [0214.766] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.767] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0214.767] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0214.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0214.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0214.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0214.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN", lpFilePart=0x0) returned 0x21 [0214.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\", lpFilePart=0x0) returned 0x22 [0214.768] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x4cf960 [0214.768] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.768] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.768] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.768] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.768] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.768] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0214.769] FindNextFileW (in: hFindFile=0x4cf960, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0214.769] FindClose (in: hFindFile=0x4cf960 | out: hFindFile=0x4cf960) returned 1 [0214.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0214.769] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0214.769] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", lpFilePart=0x0) returned 0x2a [0214.769] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", dwFileAttributes=0x80) returned 1 [0214.770] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x32 [0214.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0214.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0214.770] GetFileType (hFile=0x15c) returned 0x1 [0214.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0214.770] GetFileType (hFile=0x15c) returned 0x1 [0215.525] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", lpFilePart=0x0) returned 0x2a [0215.525] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0215.525] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0215.525] GetFileType (hFile=0x23c) returned 0x1 [0215.525] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0215.525] GetFileType (hFile=0x23c) returned 0x1 [0215.525] ReadFile (in: hFile=0x23c, lpBuffer=0x23bb780, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bb780*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0215.531] ReadFile (in: hFile=0x23c, lpBuffer=0x23bb780, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bb780*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0215.531] ReadFile (in: hFile=0x23c, lpBuffer=0x23bb780, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bb780*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0215.531] ReadFile (in: hFile=0x23c, lpBuffer=0x23bb780, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23bb780*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0215.531] CloseHandle (hObject=0x23c) returned 1 [0215.531] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", lpFilePart=0x0) returned 0x2a [0215.532] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.png")) returned 1 [0215.533] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0215.533] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25 [0215.533] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26 [0215.533] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0215.533] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.534] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0215.534] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0215.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0215.534] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0215.534] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0215.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0", lpFilePart=0x0) returned 0x25 [0215.534] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\", lpFilePart=0x0) returned 0x26 [0215.534] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0215.535] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0215.535] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0215.535] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0215.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0215.535] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0215.536] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0215.536] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", dwFileAttributes=0x80) returned 1 [0215.537] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x36 [0215.537] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0215.537] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0215.599] GetFileType (hFile=0x15c) returned 0x1 [0215.599] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0215.600] GetFileType (hFile=0x15c) returned 0x1 [0216.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0216.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0216.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0216.276] GetFileType (hFile=0x23c) returned 0x1 [0216.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0216.276] GetFileType (hFile=0x23c) returned 0x1 [0216.276] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a9620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0216.282] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a9620*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0216.282] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a9620*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0216.283] ReadFile (in: hFile=0x23c, lpBuffer=0x22a9620, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a9620*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0216.283] CloseHandle (hObject=0x23c) returned 1 [0216.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0216.283] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.png")) returned 1 [0216.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0216.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0216.286] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0216.287] GetFileType (hFile=0x15c) returned 0x1 [0216.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0216.287] GetFileType (hFile=0x15c) returned 0x1 [0216.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png", lpFilePart=0x0) returned 0x2e [0216.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0216.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0216.288] GetFileType (hFile=0x15c) returned 0x1 [0216.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0216.288] GetFileType (hFile=0x15c) returned 0x1 [0216.288] WriteFile (in: hFile=0x15c, lpBuffer=0x22b6ed8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22b6ed8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0216.289] CloseHandle (hObject=0x15c) returned 1 [0216.289] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0216.289] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0216.289] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0216.290] GetFileType (hFile=0x15c) returned 0x1 [0216.290] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0216.290] GetFileType (hFile=0x15c) returned 0x1 [0216.290] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0216.290] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0216.291] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\8.0\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\msdn\\8.0\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0216.291] GetFileType (hFile=0x15c) returned 0x1 [0216.291] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0216.291] GetFileType (hFile=0x15c) returned 0x1 [0216.292] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.TXT", lpFilePart=0x0) returned 0x2a [0216.292] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0216.292] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0216.292] GetFileType (hFile=0x15c) returned 0x1 [0216.292] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0216.292] GetFileType (hFile=0x15c) returned 0x1 [0216.293] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png", lpFilePart=0x0) returned 0x2a [0216.293] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0216.293] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0216.293] GetFileType (hFile=0x15c) returned 0x1 [0216.293] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0216.293] GetFileType (hFile=0x15c) returned 0x1 [0216.294] WriteFile (in: hFile=0x15c, lpBuffer=0x22c86e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22c86e0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0216.294] CloseHandle (hObject=0x15c) returned 1 [0216.294] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.vbs", lpFilePart=0x0) returned 0x2a [0216.295] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0216.295] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\msdn\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0216.295] GetFileType (hFile=0x15c) returned 0x1 [0216.295] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0216.295] GetFileType (hFile=0x15c) returned 0x1 [0216.296] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\MSDN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x56 [0216.296] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0216.296] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\MSDN\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\msdn\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0216.296] GetFileType (hFile=0x15c) returned 0x1 [0216.296] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0216.296] GetFileType (hFile=0x15c) returned 0x1 [0216.297] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0216.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29 [0216.297] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a [0216.297] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0216.297] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.297] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.297] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.297] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.298] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.298] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.298] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0216.298] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0216.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0216.298] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0216.298] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0216.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework", lpFilePart=0x0) returned 0x29 [0216.298] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\", lpFilePart=0x0) returned 0x2a [0216.298] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0216.298] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.298] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.298] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.299] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.299] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.299] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0216.299] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0216.299] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0216.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0216.299] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0216.299] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", lpFilePart=0x0) returned 0x32 [0216.299] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", dwFileAttributes=0x80) returned 1 [0216.300] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3a [0216.300] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0216.300] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0216.301] GetFileType (hFile=0x15c) returned 0x1 [0216.301] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0216.301] GetFileType (hFile=0x15c) returned 0x1 [0216.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", lpFilePart=0x0) returned 0x32 [0216.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0216.778] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0216.778] GetFileType (hFile=0x23c) returned 0x1 [0216.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0216.778] GetFileType (hFile=0x23c) returned 0x1 [0216.778] ReadFile (in: hFile=0x23c, lpBuffer=0x23baaa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23baaa8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0216.783] ReadFile (in: hFile=0x23c, lpBuffer=0x23baaa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23baaa8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0216.784] ReadFile (in: hFile=0x23c, lpBuffer=0x23baaa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23baaa8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0216.784] ReadFile (in: hFile=0x23c, lpBuffer=0x23baaa8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23baaa8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0216.784] CloseHandle (hObject=0x23c) returned 1 [0216.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", lpFilePart=0x0) returned 0x32 [0216.784] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.png")) returned 1 [0216.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0216.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39 [0216.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a [0216.786] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0216.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0216.786] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0216.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0216.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0216.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0216.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore", lpFilePart=0x0) returned 0x39 [0216.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\", lpFilePart=0x0) returned 0x3a [0216.787] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0216.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0216.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0216.788] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0216.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0216.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0216.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", lpFilePart=0x0) returned 0x42 [0216.788] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", dwFileAttributes=0x80) returned 1 [0216.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x4a [0216.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0216.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0216.789] GetFileType (hFile=0x15c) returned 0x1 [0216.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0216.789] GetFileType (hFile=0x15c) returned 0x1 [0217.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", lpFilePart=0x0) returned 0x42 [0217.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0217.264] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0217.264] GetFileType (hFile=0x23c) returned 0x1 [0217.264] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0217.264] GetFileType (hFile=0x23c) returned 0x1 [0217.264] ReadFile (in: hFile=0x23c, lpBuffer=0x22a91a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a91a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0217.269] ReadFile (in: hFile=0x23c, lpBuffer=0x22a91a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a91a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0217.269] ReadFile (in: hFile=0x23c, lpBuffer=0x22a91a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a91a8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0217.270] ReadFile (in: hFile=0x23c, lpBuffer=0x22a91a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a91a8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0217.270] CloseHandle (hObject=0x23c) returned 1 [0217.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", lpFilePart=0x0) returned 0x42 [0217.270] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.png")) returned 1 [0217.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.TXT", lpFilePart=0x0) returned 0x42 [0217.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0217.273] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0217.274] GetFileType (hFile=0x15c) returned 0x1 [0217.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0217.274] GetFileType (hFile=0x15c) returned 0x1 [0217.275] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png", lpFilePart=0x0) returned 0x42 [0217.275] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0217.275] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0217.275] GetFileType (hFile=0x15c) returned 0x1 [0217.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0217.275] GetFileType (hFile=0x15c) returned 0x1 [0217.275] WriteFile (in: hFile=0x15c, lpBuffer=0x22b6b00*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22b6b00*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0217.276] CloseHandle (hObject=0x15c) returned 1 [0217.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.vbs", lpFilePart=0x0) returned 0x42 [0217.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0217.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0217.277] GetFileType (hFile=0x15c) returned 0x1 [0217.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0217.277] GetFileType (hFile=0x15c) returned 0x1 [0217.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6e [0217.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0217.278] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\BreadcrumbStore\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\netframework\\breadcrumbstore\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0217.278] GetFileType (hFile=0x15c) returned 0x1 [0217.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0217.278] GetFileType (hFile=0x15c) returned 0x1 [0217.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0217.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0217.279] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0217.279] GetFileType (hFile=0x15c) returned 0x1 [0217.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0217.279] GetFileType (hFile=0x15c) returned 0x1 [0217.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png", lpFilePart=0x0) returned 0x32 [0217.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0217.280] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0217.280] GetFileType (hFile=0x15c) returned 0x1 [0217.280] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0217.280] GetFileType (hFile=0x15c) returned 0x1 [0217.280] WriteFile (in: hFile=0x15c, lpBuffer=0x22c8400*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22c8400*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0217.281] CloseHandle (hObject=0x15c) returned 1 [0217.281] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0217.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0217.282] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\netframework\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0217.282] GetFileType (hFile=0x15c) returned 0x1 [0217.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0217.282] GetFileType (hFile=0x15c) returned 0x1 [0217.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\NetFramework\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0217.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0217.283] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\NetFramework\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\netframework\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0217.283] GetFileType (hFile=0x15c) returned 0x1 [0217.283] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0217.283] GetFileType (hFile=0x15c) returned 0x1 [0217.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0217.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24 [0217.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25 [0217.284] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0217.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0217.285] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0217.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0217.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network", lpFilePart=0x0) returned 0x24 [0217.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\", lpFilePart=0x0) returned 0x25 [0217.285] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0217.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0217.287] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0217.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0217.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0217.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", lpFilePart=0x0) returned 0x2d [0217.287] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", dwFileAttributes=0x80) returned 1 [0217.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x35 [0217.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0217.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0217.288] GetFileType (hFile=0x15c) returned 0x1 [0217.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0217.288] GetFileType (hFile=0x15c) returned 0x1 [0217.755] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", lpFilePart=0x0) returned 0x2d [0217.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0217.755] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0217.756] GetFileType (hFile=0x23c) returned 0x1 [0217.756] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0217.756] GetFileType (hFile=0x23c) returned 0x1 [0217.756] ReadFile (in: hFile=0x23c, lpBuffer=0x23ba968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23ba968*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0217.759] ReadFile (in: hFile=0x23c, lpBuffer=0x23ba968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23ba968*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0217.761] ReadFile (in: hFile=0x23c, lpBuffer=0x23ba968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23ba968*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0217.761] ReadFile (in: hFile=0x23c, lpBuffer=0x23ba968, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23ba968*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0217.761] CloseHandle (hObject=0x23c) returned 1 [0217.762] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", lpFilePart=0x0) returned 0x2d [0217.762] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.png")) returned 1 [0217.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0217.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30 [0217.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31 [0217.763] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0217.764] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.764] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.764] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.764] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.764] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.764] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0217.764] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0217.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0217.764] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0217.764] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0217.764] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections", lpFilePart=0x0) returned 0x30 [0217.764] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\", lpFilePart=0x0) returned 0x31 [0217.764] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0217.765] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0217.765] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0217.765] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0217.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0217.766] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0217.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", lpFilePart=0x0) returned 0x39 [0217.766] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", dwFileAttributes=0x80) returned 1 [0217.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x41 [0217.766] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0217.766] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0217.767] GetFileType (hFile=0x15c) returned 0x1 [0217.767] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0217.767] GetFileType (hFile=0x15c) returned 0x1 [0218.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", lpFilePart=0x0) returned 0x39 [0218.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0218.269] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0218.270] GetFileType (hFile=0x23c) returned 0x1 [0218.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0218.270] GetFileType (hFile=0x23c) returned 0x1 [0218.270] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8cf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a8cf0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0218.275] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8cf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a8cf0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0218.275] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8cf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a8cf0*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0218.275] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8cf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22a8cf0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0218.275] CloseHandle (hObject=0x23c) returned 1 [0218.275] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", lpFilePart=0x0) returned 0x39 [0218.275] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.png")) returned 1 [0218.279] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.TXT", lpFilePart=0x0) returned 0x39 [0218.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0218.279] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.279] GetFileType (hFile=0x15c) returned 0x1 [0218.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0218.279] GetFileType (hFile=0x15c) returned 0x1 [0218.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png", lpFilePart=0x0) returned 0x39 [0218.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0218.280] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0218.281] GetFileType (hFile=0x15c) returned 0x1 [0218.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0218.281] GetFileType (hFile=0x15c) returned 0x1 [0218.281] WriteFile (in: hFile=0x15c, lpBuffer=0x22b6608*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22b6608*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0218.282] CloseHandle (hObject=0x15c) returned 1 [0218.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.vbs", lpFilePart=0x0) returned 0x39 [0218.282] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0218.282] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.282] GetFileType (hFile=0x15c) returned 0x1 [0218.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0218.282] GetFileType (hFile=0x15c) returned 0x1 [0218.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x65 [0218.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0218.283] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Connections\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\network\\connections\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.283] GetFileType (hFile=0x15c) returned 0x1 [0218.284] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0218.284] GetFileType (hFile=0x15c) returned 0x1 [0218.284] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0218.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f [0218.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30 [0218.284] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0218.285] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0218.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0218.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0218.286] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0218.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader", lpFilePart=0x0) returned 0x2f [0218.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\", lpFilePart=0x0) returned 0x30 [0218.286] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0218.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.287] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0218.287] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0218.287] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0218.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0218.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0218.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", lpFilePart=0x0) returned 0x38 [0218.287] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", dwFileAttributes=0x80) returned 1 [0218.288] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x40 [0218.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0218.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0218.288] GetFileType (hFile=0x15c) returned 0x1 [0218.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0218.288] GetFileType (hFile=0x15c) returned 0x1 [0218.765] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", lpFilePart=0x0) returned 0x38 [0218.765] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0218.765] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0218.765] GetFileType (hFile=0x23c) returned 0x1 [0218.765] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0218.765] GetFileType (hFile=0x23c) returned 0x1 [0218.766] ReadFile (in: hFile=0x23c, lpBuffer=0x23a90b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23a90b0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0218.771] ReadFile (in: hFile=0x23c, lpBuffer=0x23a90b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23a90b0*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0218.771] ReadFile (in: hFile=0x23c, lpBuffer=0x23a90b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23a90b0*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0218.771] ReadFile (in: hFile=0x23c, lpBuffer=0x23a90b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23a90b0*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0218.771] CloseHandle (hObject=0x23c) returned 1 [0218.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", lpFilePart=0x0) returned 0x38 [0218.771] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.png")) returned 1 [0218.774] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.TXT", lpFilePart=0x0) returned 0x38 [0218.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0218.774] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.774] GetFileType (hFile=0x15c) returned 0x1 [0218.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0218.774] GetFileType (hFile=0x15c) returned 0x1 [0218.775] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png", lpFilePart=0x0) returned 0x38 [0218.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0218.775] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0218.775] GetFileType (hFile=0x15c) returned 0x1 [0218.775] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0218.775] GetFileType (hFile=0x15c) returned 0x1 [0218.776] WriteFile (in: hFile=0x15c, lpBuffer=0x23b6a18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23b6a18*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0218.776] CloseHandle (hObject=0x15c) returned 1 [0218.777] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.vbs", lpFilePart=0x0) returned 0x38 [0218.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0218.777] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.777] GetFileType (hFile=0x15c) returned 0x1 [0218.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0218.777] GetFileType (hFile=0x15c) returned 0x1 [0218.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x64 [0218.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0218.778] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Downloader\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\network\\downloader\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.778] GetFileType (hFile=0x15c) returned 0x1 [0218.778] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0218.778] GetFileType (hFile=0x15c) returned 0x1 [0218.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0218.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0218.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.779] GetFileType (hFile=0x15c) returned 0x1 [0218.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0218.779] GetFileType (hFile=0x15c) returned 0x1 [0218.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png", lpFilePart=0x0) returned 0x2d [0218.780] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0218.780] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0218.781] GetFileType (hFile=0x15c) returned 0x1 [0218.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0218.781] GetFileType (hFile=0x15c) returned 0x1 [0218.781] WriteFile (in: hFile=0x15c, lpBuffer=0x23c82b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23c82b0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0218.782] CloseHandle (hObject=0x15c) returned 1 [0218.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0218.782] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0218.782] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\network\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.782] GetFileType (hFile=0x15c) returned 0x1 [0218.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0218.782] GetFileType (hFile=0x15c) returned 0x1 [0218.783] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0218.783] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0218.783] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Network\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\network\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0218.783] GetFileType (hFile=0x15c) returned 0x1 [0218.783] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0218.783] GetFileType (hFile=0x15c) returned 0x1 [0218.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0218.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23 [0218.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24 [0218.784] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0218.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0218.786] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0218.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0218.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0218.786] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0218.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE", lpFilePart=0x0) returned 0x23 [0218.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\", lpFilePart=0x0) returned 0x24 [0218.786] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0218.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0218.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0218.788] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0218.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0218.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0218.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", lpFilePart=0x0) returned 0x2c [0218.788] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", dwFileAttributes=0x80) returned 1 [0218.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x34 [0218.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0218.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0218.790] GetFileType (hFile=0x15c) returned 0x1 [0218.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0218.790] GetFileType (hFile=0x15c) returned 0x1 [0219.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", lpFilePart=0x0) returned 0x2c [0219.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0219.264] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0219.265] GetFileType (hFile=0x23c) returned 0x1 [0219.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0219.265] GetFileType (hFile=0x23c) returned 0x1 [0219.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbf88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbf88*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0219.270] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbf88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbf88*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0219.270] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbf88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbf88*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0219.270] ReadFile (in: hFile=0x23c, lpBuffer=0x22bbf88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22bbf88*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0219.270] CloseHandle (hObject=0x23c) returned 1 [0219.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", lpFilePart=0x0) returned 0x2c [0219.270] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.png")) returned 1 [0219.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0219.272] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e [0219.272] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f [0219.272] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0219.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0219.273] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0219.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0219.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0219.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0219.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions", lpFilePart=0x0) returned 0x2e [0219.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\", lpFilePart=0x0) returned 0x2f [0219.273] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0219.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0219.275] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0219.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0219.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0219.275] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", lpFilePart=0x0) returned 0x37 [0219.275] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", dwFileAttributes=0x80) returned 1 [0219.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3f [0219.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0219.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0219.276] GetFileType (hFile=0x15c) returned 0x1 [0219.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0219.276] GetFileType (hFile=0x15c) returned 0x1 [0219.804] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", lpFilePart=0x0) returned 0x37 [0219.804] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0219.804] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0219.804] GetFileType (hFile=0x23c) returned 0x1 [0219.804] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0219.804] GetFileType (hFile=0x23c) returned 0x1 [0219.804] ReadFile (in: hFile=0x23c, lpBuffer=0x23aa920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23aa920*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0219.809] ReadFile (in: hFile=0x23c, lpBuffer=0x23aa920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23aa920*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0219.809] ReadFile (in: hFile=0x23c, lpBuffer=0x23aa920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23aa920*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0219.810] ReadFile (in: hFile=0x23c, lpBuffer=0x23aa920, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23aa920*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0219.810] CloseHandle (hObject=0x23c) returned 1 [0219.810] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", lpFilePart=0x0) returned 0x37 [0219.810] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.png")) returned 1 [0219.811] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0219.812] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33 [0219.812] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34 [0219.812] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0219.812] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.812] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.812] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.813] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.814] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.815] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.815] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.815] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.815] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.815] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.815] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.816] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.816] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.816] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.816] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.816] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.816] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.817] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.817] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.817] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.817] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0219.817] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0219.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0219.817] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0219.817] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0219.817] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036", lpFilePart=0x0) returned 0x33 [0219.817] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\", lpFilePart=0x0) returned 0x34 [0219.818] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0219.818] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.818] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.818] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.818] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.819] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.819] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.819] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.819] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.819] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.819] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.820] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.820] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.820] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.820] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.820] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.820] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.821] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.821] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.821] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.821] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.821] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.822] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.822] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.822] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.822] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.822] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.822] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.823] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.823] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.823] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.823] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.823] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0219.824] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0219.824] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0219.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0219.824] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0219.824] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", lpFilePart=0x0) returned 0x3c [0219.824] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", dwFileAttributes=0x80) returned 1 [0219.825] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x44 [0219.825] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0219.825] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0219.826] GetFileType (hFile=0x15c) returned 0x1 [0219.826] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0219.826] GetFileType (hFile=0x15c) returned 0x1 [0220.326] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.326] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0220.326] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0220.327] GetFileType (hFile=0x23c) returned 0x1 [0220.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0220.327] GetFileType (hFile=0x23c) returned 0x1 [0220.327] ReadFile (in: hFile=0x23c, lpBuffer=0x22a10d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a10d8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0220.332] ReadFile (in: hFile=0x23c, lpBuffer=0x22a10d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a10d8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0220.332] ReadFile (in: hFile=0x23c, lpBuffer=0x22a10d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a10d8*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0220.332] ReadFile (in: hFile=0x23c, lpBuffer=0x22a10d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22a10d8*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0220.332] CloseHandle (hObject=0x23c) returned 1 [0220.332] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.332] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.png")) returned 1 [0220.336] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0220.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0220.336] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.337] GetFileType (hFile=0x15c) returned 0x1 [0220.337] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0220.337] GetFileType (hFile=0x15c) returned 0x1 [0220.338] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0220.338] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0220.339] GetFileType (hFile=0x15c) returned 0x1 [0220.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0220.339] GetFileType (hFile=0x15c) returned 0x1 [0220.339] WriteFile (in: hFile=0x15c, lpBuffer=0x22aee90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22aee90*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0220.340] CloseHandle (hObject=0x15c) returned 1 [0220.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0220.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0220.340] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.340] GetFileType (hFile=0x15c) returned 0x1 [0220.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0220.340] GetFileType (hFile=0x15c) returned 0x1 [0220.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0220.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0220.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\1036\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\1036\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.341] GetFileType (hFile=0x15c) returned 0x1 [0220.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0220.342] GetFileType (hFile=0x15c) returned 0x1 [0220.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0220.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33 [0220.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34 [0220.342] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0220.346] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0220.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0220.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0220.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0220.346] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082", lpFilePart=0x0) returned 0x33 [0220.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\", lpFilePart=0x0) returned 0x34 [0220.347] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0220.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0220.351] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0220.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0220.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0220.351] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.351] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", dwFileAttributes=0x80) returned 1 [0220.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x44 [0220.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0220.352] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0220.352] GetFileType (hFile=0x15c) returned 0x1 [0220.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0220.353] GetFileType (hFile=0x15c) returned 0x1 [0220.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0220.959] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0220.960] GetFileType (hFile=0x23c) returned 0x1 [0220.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0220.960] GetFileType (hFile=0x23c) returned 0x1 [0220.960] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23a9428*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0220.965] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23a9428*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0220.965] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23a9428*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0220.965] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9428, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23a9428*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0220.965] CloseHandle (hObject=0x23c) returned 1 [0220.965] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.965] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.png")) returned 1 [0220.969] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.TXT", lpFilePart=0x0) returned 0x3c [0220.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0220.969] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.969] GetFileType (hFile=0x15c) returned 0x1 [0220.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0220.969] GetFileType (hFile=0x15c) returned 0x1 [0220.970] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png", lpFilePart=0x0) returned 0x3c [0220.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0220.970] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0220.971] GetFileType (hFile=0x15c) returned 0x1 [0220.971] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0220.971] GetFileType (hFile=0x15c) returned 0x1 [0220.971] WriteFile (in: hFile=0x15c, lpBuffer=0x23b71e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x23b71e0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0220.973] CloseHandle (hObject=0x15c) returned 1 [0220.973] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.vbs", lpFilePart=0x0) returned 0x3c [0220.973] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0220.973] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.973] GetFileType (hFile=0x15c) returned 0x1 [0220.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0220.973] GetFileType (hFile=0x15c) returned 0x1 [0220.974] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x68 [0220.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0220.974] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\3082\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\3082\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.975] GetFileType (hFile=0x15c) returned 0x1 [0220.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0220.975] GetFileType (hFile=0x15c) returned 0x1 [0220.975] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0220.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0220.976] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.976] GetFileType (hFile=0x15c) returned 0x1 [0220.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0220.976] GetFileType (hFile=0x15c) returned 0x1 [0220.977] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png", lpFilePart=0x0) returned 0x37 [0220.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0220.977] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0220.977] GetFileType (hFile=0x15c) returned 0x1 [0220.977] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0220.977] GetFileType (hFile=0x15c) returned 0x1 [0220.977] WriteFile (in: hFile=0x15c, lpBuffer=0x23c8ad0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23c8ad0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0220.978] CloseHandle (hObject=0x15c) returned 1 [0220.978] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0220.979] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0220.979] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.979] GetFileType (hFile=0x15c) returned 0x1 [0220.979] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0220.979] GetFileType (hFile=0x15c) returned 0x1 [0220.980] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0220.980] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0220.980] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UICaptions\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\office\\uicaptions\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.980] GetFileType (hFile=0x15c) returned 0x1 [0220.980] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0220.980] GetFileType (hFile=0x15c) returned 0x1 [0220.981] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0220.981] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0220.981] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.981] GetFileType (hFile=0x15c) returned 0x1 [0220.981] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0220.981] GetFileType (hFile=0x15c) returned 0x1 [0220.982] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png", lpFilePart=0x0) returned 0x2c [0220.982] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0220.982] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0220.982] GetFileType (hFile=0x15c) returned 0x1 [0220.982] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0220.982] GetFileType (hFile=0x15c) returned 0x1 [0220.982] WriteFile (in: hFile=0x15c, lpBuffer=0x23da340*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23da340*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0220.983] CloseHandle (hObject=0x15c) returned 1 [0220.983] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0220.983] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0220.983] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\office\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.983] GetFileType (hFile=0x15c) returned 0x1 [0220.984] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0220.984] GetFileType (hFile=0x15c) returned 0x1 [0220.984] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OFFICE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0220.984] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0220.984] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OFFICE\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\office\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0220.985] GetFileType (hFile=0x15c) returned 0x1 [0220.985] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0220.985] GetFileType (hFile=0x15c) returned 0x1 [0220.985] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0220.985] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d [0220.985] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e [0220.986] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.986] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0220.987] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0220.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0220.987] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0220.987] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0220.987] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform", lpFilePart=0x0) returned 0x3d [0220.987] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\", lpFilePart=0x0) returned 0x3e [0220.987] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0220.987] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.987] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.987] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.987] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.987] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.988] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.988] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0220.988] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0220.988] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0220.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0220.988] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0220.988] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", lpFilePart=0x0) returned 0x46 [0220.988] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", dwFileAttributes=0x80) returned 1 [0220.989] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x4e [0220.989] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0220.989] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0220.990] GetFileType (hFile=0x15c) returned 0x1 [0220.990] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0220.990] GetFileType (hFile=0x15c) returned 0x1 [0221.497] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", lpFilePart=0x0) returned 0x46 [0221.497] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0221.497] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0221.498] GetFileType (hFile=0x23c) returned 0x1 [0221.498] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0221.498] GetFileType (hFile=0x23c) returned 0x1 [0221.498] ReadFile (in: hFile=0x23c, lpBuffer=0x22c97b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c97b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0221.505] ReadFile (in: hFile=0x23c, lpBuffer=0x22c97b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c97b8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0221.505] ReadFile (in: hFile=0x23c, lpBuffer=0x22c97b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c97b8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0221.505] ReadFile (in: hFile=0x23c, lpBuffer=0x22c97b8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c97b8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0221.505] CloseHandle (hObject=0x23c) returned 1 [0221.506] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", lpFilePart=0x0) returned 0x46 [0221.506] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.png")) returned 1 [0221.507] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0221.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43 [0221.507] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44 [0221.508] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.508] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0221.508] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0221.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0221.509] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0221.509] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0221.509] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache", lpFilePart=0x0) returned 0x43 [0221.509] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\", lpFilePart=0x0) returned 0x44 [0221.509] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0221.509] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.509] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.509] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.509] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.509] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.510] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0221.510] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0221.510] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0221.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0221.510] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0221.510] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", lpFilePart=0x0) returned 0x4c [0221.510] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", dwFileAttributes=0x80) returned 1 [0221.511] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x54 [0221.511] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0221.511] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0221.511] GetFileType (hFile=0x15c) returned 0x1 [0221.512] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0221.512] GetFileType (hFile=0x15c) returned 0x1 [0222.006] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", lpFilePart=0x0) returned 0x4c [0222.006] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0222.006] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0222.006] GetFileType (hFile=0x23c) returned 0x1 [0222.006] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0222.006] GetFileType (hFile=0x23c) returned 0x1 [0222.006] ReadFile (in: hFile=0x23c, lpBuffer=0x23b5e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b5e68*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0222.012] ReadFile (in: hFile=0x23c, lpBuffer=0x23b5e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b5e68*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0222.012] ReadFile (in: hFile=0x23c, lpBuffer=0x23b5e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b5e68*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0222.012] ReadFile (in: hFile=0x23c, lpBuffer=0x23b5e68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b5e68*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0222.012] CloseHandle (hObject=0x23c) returned 1 [0222.012] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", lpFilePart=0x0) returned 0x4c [0222.013] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.png")) returned 1 [0222.016] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0222.016] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0222.016] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0222.016] GetFileType (hFile=0x15c) returned 0x1 [0222.017] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0222.017] GetFileType (hFile=0x15c) returned 0x1 [0222.018] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png", lpFilePart=0x0) returned 0x4c [0222.018] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0222.018] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0222.019] GetFileType (hFile=0x15c) returned 0x1 [0222.019] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0222.019] GetFileType (hFile=0x15c) returned 0x1 [0222.019] WriteFile (in: hFile=0x15c, lpBuffer=0x23c3820*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23c3820*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0222.020] CloseHandle (hObject=0x15c) returned 1 [0222.021] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0222.021] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0222.021] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0222.021] GetFileType (hFile=0x15c) returned 0x1 [0222.021] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0222.021] GetFileType (hFile=0x15c) returned 0x1 [0222.022] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0222.022] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0222.022] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\cache\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0222.023] GetFileType (hFile=0x15c) returned 0x1 [0222.023] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0222.023] GetFileType (hFile=0x15c) returned 0x1 [0222.024] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.TXT", lpFilePart=0x0) returned 0x46 [0222.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0222.024] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0222.024] GetFileType (hFile=0x15c) returned 0x1 [0222.024] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0222.024] GetFileType (hFile=0x15c) returned 0x1 [0222.025] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png", lpFilePart=0x0) returned 0x46 [0222.025] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0222.025] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0222.026] GetFileType (hFile=0x15c) returned 0x1 [0222.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0222.026] GetFileType (hFile=0x15c) returned 0x1 [0222.026] WriteFile (in: hFile=0x15c, lpBuffer=0x23d5210*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23d5210*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0222.027] CloseHandle (hObject=0x15c) returned 1 [0222.027] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.vbs", lpFilePart=0x0) returned 0x46 [0222.027] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0222.027] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0222.027] GetFileType (hFile=0x15c) returned 0x1 [0222.027] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0222.027] GetFileType (hFile=0x15c) returned 0x1 [0222.028] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x72 [0222.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0222.028] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\OfficeSoftwareProtectionPlatform\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\officesoftwareprotectionplatform\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0222.029] GetFileType (hFile=0x15c) returned 0x1 [0222.029] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0222.029] GetFileType (hFile=0x15c) returned 0x1 [0222.029] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0222.029] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20 [0222.030] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21 [0222.030] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0222.030] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.030] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.031] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.031] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.031] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.031] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0222.031] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0222.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0222.031] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0222.031] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0222.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC", lpFilePart=0x0) returned 0x20 [0222.031] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\", lpFilePart=0x0) returned 0x21 [0222.031] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.032] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0222.033] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0222.033] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0222.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0222.033] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0222.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", lpFilePart=0x0) returned 0x29 [0222.033] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", dwFileAttributes=0x80) returned 1 [0222.037] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x31 [0222.037] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0222.037] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0222.038] GetFileType (hFile=0x15c) returned 0x1 [0222.038] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0222.038] GetFileType (hFile=0x15c) returned 0x1 [0222.547] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", lpFilePart=0x0) returned 0x29 [0222.547] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0222.547] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0222.547] GetFileType (hFile=0x23c) returned 0x1 [0222.547] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0222.547] GetFileType (hFile=0x23c) returned 0x1 [0222.547] ReadFile (in: hFile=0x23c, lpBuffer=0x22c5228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c5228*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0222.553] ReadFile (in: hFile=0x23c, lpBuffer=0x22c5228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c5228*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0222.553] ReadFile (in: hFile=0x23c, lpBuffer=0x22c5228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c5228*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0222.553] ReadFile (in: hFile=0x23c, lpBuffer=0x22c5228, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22c5228*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0222.553] CloseHandle (hObject=0x23c) returned 1 [0222.553] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", lpFilePart=0x0) returned 0x29 [0222.553] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.png")) returned 1 [0222.554] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0222.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29 [0222.554] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a [0222.554] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0222.555] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.555] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.555] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.555] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.555] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.555] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0222.555] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0222.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0222.555] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0222.556] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0222.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound", lpFilePart=0x0) returned 0x29 [0222.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\", lpFilePart=0x0) returned 0x2a [0222.556] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0222.556] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.556] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.556] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.556] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.556] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0222.557] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0222.557] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0222.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0222.557] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0222.557] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", lpFilePart=0x0) returned 0x32 [0222.557] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", dwFileAttributes=0x80) returned 1 [0222.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3a [0222.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0222.558] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0222.560] GetFileType (hFile=0x15c) returned 0x1 [0222.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0222.560] GetFileType (hFile=0x15c) returned 0x1 [0223.043] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", lpFilePart=0x0) returned 0x32 [0223.044] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0223.044] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0223.044] GetFileType (hFile=0x23c) returned 0x1 [0223.044] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0223.044] GetFileType (hFile=0x23c) returned 0x1 [0223.044] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b0a50*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0223.049] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b0a50*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0223.050] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b0a50*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0223.050] ReadFile (in: hFile=0x23c, lpBuffer=0x23b0a50, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x23b0a50*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0223.050] CloseHandle (hObject=0x23c) returned 1 [0223.050] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", lpFilePart=0x0) returned 0x32 [0223.050] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.png")) returned 1 [0223.054] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.TXT", lpFilePart=0x0) returned 0x32 [0223.054] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0223.054] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0223.054] GetFileType (hFile=0x15c) returned 0x1 [0223.054] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0223.054] GetFileType (hFile=0x15c) returned 0x1 [0223.055] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png", lpFilePart=0x0) returned 0x32 [0223.055] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0223.055] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0223.055] GetFileType (hFile=0x15c) returned 0x1 [0223.055] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0223.055] GetFileType (hFile=0x15c) returned 0x1 [0223.056] WriteFile (in: hFile=0x15c, lpBuffer=0x23be328*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x23be328*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0223.056] CloseHandle (hObject=0x15c) returned 1 [0223.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.vbs", lpFilePart=0x0) returned 0x32 [0223.057] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0223.057] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0223.057] GetFileType (hFile=0x15c) returned 0x1 [0223.057] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0223.057] GetFileType (hFile=0x15c) returned 0x1 [0223.058] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5e [0223.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0223.058] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Outbound\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\rac\\outbound\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0223.058] GetFileType (hFile=0x15c) returned 0x1 [0223.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0223.058] GetFileType (hFile=0x15c) returned 0x1 [0223.059] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0223.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e [0223.059] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f [0223.059] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0223.059] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0223.060] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0223.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0223.060] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0223.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0223.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData", lpFilePart=0x0) returned 0x2e [0223.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\", lpFilePart=0x0) returned 0x2f [0223.060] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0223.061] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0223.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0223.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0223.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", lpFilePart=0x0) returned 0x37 [0223.062] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", dwFileAttributes=0x80) returned 1 [0223.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3f [0223.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0223.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0223.063] GetFileType (hFile=0x15c) returned 0x1 [0223.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0223.063] GetFileType (hFile=0x15c) returned 0x1 [0223.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", lpFilePart=0x0) returned 0x37 [0223.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0223.569] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0223.569] GetFileType (hFile=0x23c) returned 0x1 [0223.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0223.569] GetFileType (hFile=0x23c) returned 0x1 [0223.569] ReadFile (in: hFile=0x23c, lpBuffer=0x228cb88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cb88*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0223.574] ReadFile (in: hFile=0x23c, lpBuffer=0x228cb88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cb88*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0223.574] ReadFile (in: hFile=0x23c, lpBuffer=0x228cb88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cb88*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0223.575] ReadFile (in: hFile=0x23c, lpBuffer=0x228cb88, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cb88*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0223.575] CloseHandle (hObject=0x23c) returned 1 [0223.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", lpFilePart=0x0) returned 0x37 [0223.575] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.png")) returned 1 [0223.576] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.TXT", lpFilePart=0x0) returned 0x37 [0223.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0223.576] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0223.577] GetFileType (hFile=0x15c) returned 0x1 [0223.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0223.577] GetFileType (hFile=0x15c) returned 0x1 [0223.577] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png", lpFilePart=0x0) returned 0x37 [0223.577] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0223.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0223.578] GetFileType (hFile=0x15c) returned 0x1 [0223.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0223.578] GetFileType (hFile=0x15c) returned 0x1 [0223.578] WriteFile (in: hFile=0x15c, lpBuffer=0x229a4a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x229a4a8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0223.579] CloseHandle (hObject=0x15c) returned 1 [0223.579] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.vbs", lpFilePart=0x0) returned 0x37 [0223.579] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0223.579] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0223.579] GetFileType (hFile=0x15c) returned 0x1 [0223.579] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0223.579] GetFileType (hFile=0x15c) returned 0x1 [0223.580] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x63 [0223.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0223.580] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\PublishedData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\rac\\publisheddata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0223.580] GetFileType (hFile=0x15c) returned 0x1 [0223.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0223.580] GetFileType (hFile=0x15c) returned 0x1 [0223.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0223.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a [0223.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b [0223.581] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0223.581] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.581] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.581] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.582] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0223.582] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0223.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0223.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0223.582] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0223.582] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData", lpFilePart=0x0) returned 0x2a [0223.582] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\", lpFilePart=0x0) returned 0x2b [0223.583] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0223.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0223.584] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0223.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0223.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0223.584] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", lpFilePart=0x0) returned 0x33 [0223.584] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", dwFileAttributes=0x80) returned 1 [0223.585] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3b [0223.585] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0223.585] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0223.586] GetFileType (hFile=0x15c) returned 0x1 [0223.586] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0223.586] GetFileType (hFile=0x15c) returned 0x1 [0224.057] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", lpFilePart=0x0) returned 0x33 [0224.058] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0224.058] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0224.058] GetFileType (hFile=0x23c) returned 0x1 [0224.058] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0224.058] GetFileType (hFile=0x23c) returned 0x1 [0224.058] ReadFile (in: hFile=0x23c, lpBuffer=0x238d718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x238d718*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0224.070] ReadFile (in: hFile=0x23c, lpBuffer=0x238d718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x238d718*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0224.070] ReadFile (in: hFile=0x23c, lpBuffer=0x238d718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x238d718*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0224.070] ReadFile (in: hFile=0x23c, lpBuffer=0x238d718, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x238d718*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0224.070] CloseHandle (hObject=0x23c) returned 1 [0224.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", lpFilePart=0x0) returned 0x33 [0224.071] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.png")) returned 1 [0224.073] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.TXT", lpFilePart=0x0) returned 0x33 [0224.073] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0224.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.074] GetFileType (hFile=0x15c) returned 0x1 [0224.074] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0224.074] GetFileType (hFile=0x15c) returned 0x1 [0224.075] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png", lpFilePart=0x0) returned 0x33 [0224.075] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0224.075] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0224.075] GetFileType (hFile=0x15c) returned 0x1 [0224.075] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0224.075] GetFileType (hFile=0x15c) returned 0x1 [0224.075] WriteFile (in: hFile=0x15c, lpBuffer=0x239b090*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x239b090*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0224.076] CloseHandle (hObject=0x15c) returned 1 [0224.076] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.vbs", lpFilePart=0x0) returned 0x33 [0224.076] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0224.077] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.077] GetFileType (hFile=0x15c) returned 0x1 [0224.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0224.077] GetFileType (hFile=0x15c) returned 0x1 [0224.078] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5f [0224.078] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0224.078] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\StateData\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\rac\\statedata\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.078] GetFileType (hFile=0x15c) returned 0x1 [0224.078] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0224.078] GetFileType (hFile=0x15c) returned 0x1 [0224.079] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0224.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25 [0224.079] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26 [0224.079] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0224.079] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.080] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.080] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.080] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.080] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.080] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0224.080] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0224.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0224.080] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0224.080] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0224.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp", lpFilePart=0x0) returned 0x25 [0224.080] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\", lpFilePart=0x0) returned 0x26 [0224.080] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0224.081] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.081] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.081] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.081] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.081] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0224.081] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0224.081] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0224.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0224.081] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0224.081] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", lpFilePart=0x0) returned 0x2e [0224.081] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", dwFileAttributes=0x80) returned 1 [0224.082] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x36 [0224.082] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0224.082] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0224.083] GetFileType (hFile=0x15c) returned 0x1 [0224.083] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0224.083] GetFileType (hFile=0x15c) returned 0x1 [0224.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", lpFilePart=0x0) returned 0x2e [0224.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0224.666] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0224.667] GetFileType (hFile=0x23c) returned 0x1 [0224.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0224.667] GetFileType (hFile=0x23c) returned 0x1 [0224.667] ReadFile (in: hFile=0x23c, lpBuffer=0x228cee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cee8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0224.668] ReadFile (in: hFile=0x23c, lpBuffer=0x228cee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cee8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0224.672] ReadFile (in: hFile=0x23c, lpBuffer=0x228cee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cee8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0224.672] ReadFile (in: hFile=0x23c, lpBuffer=0x228cee8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228cee8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0224.672] CloseHandle (hObject=0x23c) returned 1 [0224.673] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", lpFilePart=0x0) returned 0x2e [0224.673] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.png")) returned 1 [0224.674] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.TXT", lpFilePart=0x0) returned 0x2e [0224.674] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0224.674] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.675] GetFileType (hFile=0x15c) returned 0x1 [0224.675] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0224.675] GetFileType (hFile=0x15c) returned 0x1 [0224.675] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png", lpFilePart=0x0) returned 0x2e [0224.676] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0224.676] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0224.676] GetFileType (hFile=0x15c) returned 0x1 [0224.676] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0224.676] GetFileType (hFile=0x15c) returned 0x1 [0224.676] WriteFile (in: hFile=0x15c, lpBuffer=0x229a7a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x229a7a0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0224.677] CloseHandle (hObject=0x15c) returned 1 [0224.677] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.vbs", lpFilePart=0x0) returned 0x2e [0224.677] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0224.677] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.677] GetFileType (hFile=0x15c) returned 0x1 [0224.677] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0224.677] GetFileType (hFile=0x15c) returned 0x1 [0224.678] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5a [0224.678] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0224.678] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\rac\\temp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.678] GetFileType (hFile=0x15c) returned 0x1 [0224.678] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0224.678] GetFileType (hFile=0x15c) returned 0x1 [0224.679] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.TXT", lpFilePart=0x0) returned 0x29 [0224.679] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0224.679] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.680] GetFileType (hFile=0x15c) returned 0x1 [0224.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0224.680] GetFileType (hFile=0x15c) returned 0x1 [0224.680] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png", lpFilePart=0x0) returned 0x29 [0224.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0224.680] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0224.681] GetFileType (hFile=0x15c) returned 0x1 [0224.681] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0224.681] GetFileType (hFile=0x15c) returned 0x1 [0224.681] WriteFile (in: hFile=0x15c, lpBuffer=0x22abfa8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22abfa8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0224.682] CloseHandle (hObject=0x15c) returned 1 [0224.682] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.vbs", lpFilePart=0x0) returned 0x29 [0224.682] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0224.682] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\rac\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.682] GetFileType (hFile=0x15c) returned 0x1 [0224.682] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0224.682] GetFileType (hFile=0x15c) returned 0x1 [0224.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\RAC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x55 [0224.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0224.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\RAC\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\rac\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0224.683] GetFileType (hFile=0x15c) returned 0x1 [0224.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0224.683] GetFileType (hFile=0x15c) returned 0x1 [0224.684] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0224.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23 [0224.684] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24 [0224.684] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0224.684] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.684] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.684] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.685] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.685] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.685] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.685] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0224.685] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0224.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0224.685] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0224.685] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0224.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search", lpFilePart=0x0) returned 0x23 [0224.685] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\", lpFilePart=0x0) returned 0x24 [0224.685] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0224.685] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.685] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.686] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.686] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.686] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.686] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0224.686] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0224.686] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0224.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0224.686] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0224.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", lpFilePart=0x0) returned 0x2c [0224.686] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", dwFileAttributes=0x80) returned 1 [0224.687] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x34 [0224.687] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0224.687] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0224.688] GetFileType (hFile=0x15c) returned 0x1 [0224.688] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0224.688] GetFileType (hFile=0x15c) returned 0x1 [0225.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", lpFilePart=0x0) returned 0x2c [0225.190] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0225.190] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0225.190] GetFileType (hFile=0x23c) returned 0x1 [0225.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0225.190] GetFileType (hFile=0x23c) returned 0x1 [0225.190] ReadFile (in: hFile=0x23c, lpBuffer=0x239e000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239e000*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0225.195] ReadFile (in: hFile=0x23c, lpBuffer=0x239e000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239e000*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0225.195] ReadFile (in: hFile=0x23c, lpBuffer=0x239e000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239e000*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0225.196] ReadFile (in: hFile=0x23c, lpBuffer=0x239e000, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239e000*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0225.196] CloseHandle (hObject=0x23c) returned 1 [0225.196] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", lpFilePart=0x0) returned 0x2c [0225.196] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.png")) returned 1 [0225.197] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0225.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28 [0225.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29 [0225.197] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0225.198] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0225.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0225.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0225.199] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0225.199] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data", lpFilePart=0x0) returned 0x28 [0225.199] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\", lpFilePart=0x0) returned 0x29 [0225.199] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0225.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.200] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0225.200] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0225.200] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0225.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0225.200] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0225.200] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", lpFilePart=0x0) returned 0x31 [0225.200] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", dwFileAttributes=0x80) returned 1 [0225.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x39 [0225.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0225.201] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0225.201] GetFileType (hFile=0x15c) returned 0x1 [0225.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0225.201] GetFileType (hFile=0x15c) returned 0x1 [0225.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", lpFilePart=0x0) returned 0x31 [0225.686] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0225.686] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0225.687] GetFileType (hFile=0x23c) returned 0x1 [0225.687] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0225.687] GetFileType (hFile=0x23c) returned 0x1 [0225.687] ReadFile (in: hFile=0x23c, lpBuffer=0x228c810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228c810*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0225.692] ReadFile (in: hFile=0x23c, lpBuffer=0x228c810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228c810*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0225.692] ReadFile (in: hFile=0x23c, lpBuffer=0x228c810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228c810*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0225.692] ReadFile (in: hFile=0x23c, lpBuffer=0x228c810, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x228c810*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0225.692] CloseHandle (hObject=0x23c) returned 1 [0225.693] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", lpFilePart=0x0) returned 0x31 [0225.693] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.png")) returned 1 [0225.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0225.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35 [0225.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36 [0225.694] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.695] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0225.695] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0225.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0225.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0225.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0225.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications", lpFilePart=0x0) returned 0x35 [0225.696] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\", lpFilePart=0x0) returned 0x36 [0225.696] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0225.696] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.696] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.696] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.696] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.696] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.696] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0225.697] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0225.697] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0225.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0225.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0225.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", lpFilePart=0x0) returned 0x3e [0225.697] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", dwFileAttributes=0x80) returned 1 [0225.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x46 [0225.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0225.698] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0225.699] GetFileType (hFile=0x15c) returned 0x1 [0225.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0225.699] GetFileType (hFile=0x15c) returned 0x1 [0226.204] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", lpFilePart=0x0) returned 0x3e [0226.204] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0226.205] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0226.205] GetFileType (hFile=0x23c) returned 0x1 [0226.205] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0226.205] GetFileType (hFile=0x23c) returned 0x1 [0226.205] ReadFile (in: hFile=0x23c, lpBuffer=0x237b060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x237b060*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0226.210] ReadFile (in: hFile=0x23c, lpBuffer=0x237b060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x237b060*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0226.210] ReadFile (in: hFile=0x23c, lpBuffer=0x237b060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x237b060*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0226.210] ReadFile (in: hFile=0x23c, lpBuffer=0x237b060, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x237b060*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0226.211] CloseHandle (hObject=0x23c) returned 1 [0226.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", lpFilePart=0x0) returned 0x3e [0226.211] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.png")) returned 1 [0226.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.TXT", lpFilePart=0x0) returned 0x3e [0226.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0226.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.215] GetFileType (hFile=0x15c) returned 0x1 [0226.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0226.215] GetFileType (hFile=0x15c) returned 0x1 [0226.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png", lpFilePart=0x0) returned 0x3e [0226.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0226.216] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0226.216] GetFileType (hFile=0x15c) returned 0x1 [0226.216] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0226.216] GetFileType (hFile=0x15c) returned 0x1 [0226.217] WriteFile (in: hFile=0x15c, lpBuffer=0x2388998*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2388998*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0226.218] CloseHandle (hObject=0x15c) returned 1 [0226.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.vbs", lpFilePart=0x0) returned 0x3e [0226.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0226.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.218] GetFileType (hFile=0x15c) returned 0x1 [0226.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0226.218] GetFileType (hFile=0x15c) returned 0x1 [0226.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x6a [0226.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0226.219] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Applications\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\applications\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.219] GetFileType (hFile=0x15c) returned 0x1 [0226.220] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0226.220] GetFileType (hFile=0x15c) returned 0x1 [0226.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0226.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d [0226.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e [0226.220] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0226.221] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.221] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.221] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.221] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.221] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.221] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0226.221] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0226.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0226.221] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0226.221] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0226.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp", lpFilePart=0x0) returned 0x2d [0226.221] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\", lpFilePart=0x0) returned 0x2e [0226.222] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0226.222] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.222] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.222] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.222] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.222] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0226.222] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0226.222] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0226.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0226.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0226.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", lpFilePart=0x0) returned 0x36 [0226.223] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", dwFileAttributes=0x80) returned 1 [0226.223] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x3e [0226.223] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0226.224] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0226.225] GetFileType (hFile=0x15c) returned 0x1 [0226.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0226.225] GetFileType (hFile=0x15c) returned 0x1 [0226.723] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", lpFilePart=0x0) returned 0x36 [0226.723] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0226.723] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0226.724] GetFileType (hFile=0x23c) returned 0x1 [0226.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0226.724] GetFileType (hFile=0x23c) returned 0x1 [0226.724] ReadFile (in: hFile=0x23c, lpBuffer=0x227ab98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x227ab98*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0226.726] ReadFile (in: hFile=0x23c, lpBuffer=0x227ab98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x227ab98*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0226.729] ReadFile (in: hFile=0x23c, lpBuffer=0x227ab98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x227ab98*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0226.729] ReadFile (in: hFile=0x23c, lpBuffer=0x227ab98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x227ab98*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0226.730] CloseHandle (hObject=0x23c) returned 1 [0226.730] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", lpFilePart=0x0) returned 0x36 [0226.730] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.png")) returned 1 [0226.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.TXT", lpFilePart=0x0) returned 0x36 [0226.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0226.731] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.732] GetFileType (hFile=0x15c) returned 0x1 [0226.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0226.732] GetFileType (hFile=0x15c) returned 0x1 [0226.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png", lpFilePart=0x0) returned 0x36 [0226.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0226.732] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0226.733] GetFileType (hFile=0x15c) returned 0x1 [0226.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0226.733] GetFileType (hFile=0x15c) returned 0x1 [0226.733] WriteFile (in: hFile=0x15c, lpBuffer=0x2288490*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2288490*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0226.734] CloseHandle (hObject=0x15c) returned 1 [0226.734] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.vbs", lpFilePart=0x0) returned 0x36 [0226.734] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0226.734] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.734] GetFileType (hFile=0x15c) returned 0x1 [0226.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0226.734] GetFileType (hFile=0x15c) returned 0x1 [0226.735] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x62 [0226.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0226.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Temp\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\temp\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.735] GetFileType (hFile=0x15c) returned 0x1 [0226.735] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0226.735] GetFileType (hFile=0x15c) returned 0x1 [0226.736] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.TXT", lpFilePart=0x0) returned 0x31 [0226.736] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0226.736] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.736] GetFileType (hFile=0x15c) returned 0x1 [0226.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0226.737] GetFileType (hFile=0x15c) returned 0x1 [0226.737] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png", lpFilePart=0x0) returned 0x31 [0226.737] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0226.737] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0226.738] GetFileType (hFile=0x15c) returned 0x1 [0226.738] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0226.738] GetFileType (hFile=0x15c) returned 0x1 [0226.738] WriteFile (in: hFile=0x15c, lpBuffer=0x2299d18*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2299d18*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0226.741] CloseHandle (hObject=0x15c) returned 1 [0226.742] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.vbs", lpFilePart=0x0) returned 0x31 [0226.742] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0226.742] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.742] GetFileType (hFile=0x15c) returned 0x1 [0226.742] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0226.742] GetFileType (hFile=0x15c) returned 0x1 [0226.743] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x5d [0226.743] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0226.744] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Data\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\search\\data\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.744] GetFileType (hFile=0x15c) returned 0x1 [0226.744] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0226.744] GetFileType (hFile=0x15c) returned 0x1 [0226.745] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.TXT", lpFilePart=0x0) returned 0x2c [0226.745] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0226.745] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.745] GetFileType (hFile=0x15c) returned 0x1 [0226.745] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0226.746] GetFileType (hFile=0x15c) returned 0x1 [0226.746] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png", lpFilePart=0x0) returned 0x2c [0226.746] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0226.746] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0226.747] GetFileType (hFile=0x15c) returned 0x1 [0226.747] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0226.747] GetFileType (hFile=0x15c) returned 0x1 [0226.747] WriteFile (in: hFile=0x15c, lpBuffer=0x22ab560*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22ab560*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0226.748] CloseHandle (hObject=0x15c) returned 1 [0226.748] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\Hack.vbs", lpFilePart=0x0) returned 0x2c [0226.748] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0226.748] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\search\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.748] GetFileType (hFile=0x15c) returned 0x1 [0226.748] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0226.748] GetFileType (hFile=0x15c) returned 0x1 [0226.749] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x58 [0226.749] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0226.749] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Search\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\search\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0226.750] GetFileType (hFile=0x15c) returned 0x1 [0226.750] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0226.750] GetFileType (hFile=0x15c) returned 0x1 [0226.750] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0226.750] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32 [0226.751] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33 [0226.751] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.751] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.752] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.752] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.752] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0226.752] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0226.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0226.752] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0226.752] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0226.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures", lpFilePart=0x0) returned 0x32 [0226.752] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\", lpFilePart=0x0) returned 0x33 [0226.752] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0226.752] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.752] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0226.753] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0226.754] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0226.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0226.754] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0226.754] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", lpFilePart=0x0) returned 0x3b [0226.754] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", dwFileAttributes=0x80) returned 1 [0226.755] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x43 [0226.755] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0226.755] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0226.755] GetFileType (hFile=0x15c) returned 0x1 [0226.755] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0226.755] GetFileType (hFile=0x15c) returned 0x1 [0227.331] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", lpFilePart=0x0) returned 0x3b [0227.331] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0227.331] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0227.331] GetFileType (hFile=0x23c) returned 0x1 [0227.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0227.331] GetFileType (hFile=0x23c) returned 0x1 [0227.331] ReadFile (in: hFile=0x23c, lpBuffer=0x239ea28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239ea28*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0227.338] ReadFile (in: hFile=0x23c, lpBuffer=0x239ea28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239ea28*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0227.338] ReadFile (in: hFile=0x23c, lpBuffer=0x239ea28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239ea28*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0227.338] ReadFile (in: hFile=0x23c, lpBuffer=0x239ea28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x239ea28*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0227.338] CloseHandle (hObject=0x23c) returned 1 [0227.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", lpFilePart=0x0) returned 0x3b [0227.339] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.png")) returned 1 [0227.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0227.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43 [0227.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44 [0227.341] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0227.341] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.341] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.341] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.341] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.345] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0227.347] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0227.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0227.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0227.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0227.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures", lpFilePart=0x0) returned 0x43 [0227.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\", lpFilePart=0x0) returned 0x44 [0227.347] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0227.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.349] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.350] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.351] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.352] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.353] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.353] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.353] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.353] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.353] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0227.353] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0227.353] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0227.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0227.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0227.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", lpFilePart=0x0) returned 0x4c [0227.354] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", dwFileAttributes=0x80) returned 1 [0227.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x54 [0227.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0227.355] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0227.356] GetFileType (hFile=0x15c) returned 0x1 [0227.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0227.356] GetFileType (hFile=0x15c) returned 0x1 [0228.012] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", lpFilePart=0x0) returned 0x4c [0228.012] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0228.012] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0228.013] GetFileType (hFile=0x23c) returned 0x1 [0228.013] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0228.013] GetFileType (hFile=0x23c) returned 0x1 [0228.013] ReadFile (in: hFile=0x23c, lpBuffer=0x2298478, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2298478*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0228.019] ReadFile (in: hFile=0x23c, lpBuffer=0x2298478, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2298478*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0228.019] ReadFile (in: hFile=0x23c, lpBuffer=0x2298478, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2298478*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0228.020] ReadFile (in: hFile=0x23c, lpBuffer=0x2298478, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2298478*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0228.020] CloseHandle (hObject=0x23c) returned 1 [0228.020] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", lpFilePart=0x0) returned 0x4c [0228.020] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.png")) returned 1 [0228.024] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.TXT", lpFilePart=0x0) returned 0x4c [0228.024] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0228.024] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.025] GetFileType (hFile=0x15c) returned 0x1 [0228.025] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0228.025] GetFileType (hFile=0x15c) returned 0x1 [0228.026] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png", lpFilePart=0x0) returned 0x4c [0228.026] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0228.026] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0228.026] GetFileType (hFile=0x15c) returned 0x1 [0228.026] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0228.026] GetFileType (hFile=0x15c) returned 0x1 [0228.027] WriteFile (in: hFile=0x15c, lpBuffer=0x22a63a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22a63a8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0228.028] CloseHandle (hObject=0x15c) returned 1 [0228.028] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.vbs", lpFilePart=0x0) returned 0x4c [0228.028] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0228.028] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.028] GetFileType (hFile=0x15c) returned 0x1 [0228.028] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0228.028] GetFileType (hFile=0x15c) returned 0x1 [0228.030] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x78 [0228.030] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0228.030] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Default Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\default pictures\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.030] GetFileType (hFile=0x15c) returned 0x1 [0228.030] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0228.030] GetFileType (hFile=0x15c) returned 0x1 [0228.032] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.TXT", lpFilePart=0x0) returned 0x3b [0228.032] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0228.032] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.032] GetFileType (hFile=0x15c) returned 0x1 [0228.032] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0228.032] GetFileType (hFile=0x15c) returned 0x1 [0228.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png", lpFilePart=0x0) returned 0x3b [0228.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0228.033] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0228.034] GetFileType (hFile=0x15c) returned 0x1 [0228.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0228.034] GetFileType (hFile=0x15c) returned 0x1 [0228.034] WriteFile (in: hFile=0x15c, lpBuffer=0x22b7d50*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22b7d50*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0228.036] CloseHandle (hObject=0x15c) returned 1 [0228.036] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.vbs", lpFilePart=0x0) returned 0x3b [0228.036] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0228.036] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.037] GetFileType (hFile=0x15c) returned 0x1 [0228.037] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0228.037] GetFileType (hFile=0x15c) returned 0x1 [0228.038] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x67 [0228.038] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0228.038] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\User Account Pictures\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\user account pictures\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.039] GetFileType (hFile=0x15c) returned 0x1 [0228.039] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0228.039] GetFileType (hFile=0x15c) returned 0x1 [0228.060] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0228.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22 [0228.060] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23 [0228.060] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0228.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.060] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.061] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0228.061] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0228.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0228.061] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0228.061] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0228.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault", lpFilePart=0x0) returned 0x22 [0228.061] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\", lpFilePart=0x0) returned 0x23 [0228.061] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0228.062] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.062] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.062] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.062] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.062] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.062] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0228.063] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0228.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0228.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0228.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", lpFilePart=0x0) returned 0x2b [0228.063] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", dwFileAttributes=0x80) returned 1 [0228.064] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x33 [0228.064] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0228.064] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0228.082] GetFileType (hFile=0x15c) returned 0x1 [0228.082] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0228.082] GetFileType (hFile=0x15c) returned 0x1 [0228.683] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", lpFilePart=0x0) returned 0x2b [0228.683] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0228.683] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0228.683] GetFileType (hFile=0x23c) returned 0x1 [0228.683] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0228.683] GetFileType (hFile=0x23c) returned 0x1 [0228.683] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a9a18*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0228.688] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a9a18*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0228.689] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a9a18*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0228.689] ReadFile (in: hFile=0x23c, lpBuffer=0x23a9a18, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a9a18*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0228.689] CloseHandle (hObject=0x23c) returned 1 [0228.689] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", lpFilePart=0x0) returned 0x2b [0228.689] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.png")) returned 1 [0228.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.TXT", lpFilePart=0x0) returned 0x2b [0228.692] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0228.692] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.693] GetFileType (hFile=0x15c) returned 0x1 [0228.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0228.693] GetFileType (hFile=0x15c) returned 0x1 [0228.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png", lpFilePart=0x0) returned 0x2b [0228.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0228.694] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0228.694] GetFileType (hFile=0x15c) returned 0x1 [0228.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0228.694] GetFileType (hFile=0x15c) returned 0x1 [0228.694] WriteFile (in: hFile=0x15c, lpBuffer=0x23b72b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23b72b0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0228.695] CloseHandle (hObject=0x15c) returned 1 [0228.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.vbs", lpFilePart=0x0) returned 0x2b [0228.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0228.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\vault\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.696] GetFileType (hFile=0x15c) returned 0x1 [0228.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0228.696] GetFileType (hFile=0x15c) returned 0x1 [0228.696] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Vault\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x57 [0228.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0228.696] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Vault\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\vault\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0228.697] GetFileType (hFile=0x15c) returned 0x1 [0228.697] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0228.697] GetFileType (hFile=0x15c) returned 0x1 [0228.698] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0228.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22 [0228.698] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23 [0228.698] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0228.698] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.698] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.698] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.698] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.698] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.698] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0228.699] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0228.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0228.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0228.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0228.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO", lpFilePart=0x0) returned 0x22 [0228.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\", lpFilePart=0x0) returned 0x23 [0228.699] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0228.699] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.699] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.699] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.699] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.699] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0228.700] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0228.700] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0228.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0228.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0228.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", lpFilePart=0x0) returned 0x2b [0228.700] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", dwFileAttributes=0x80) returned 1 [0228.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x33 [0228.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0228.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0228.716] GetFileType (hFile=0x15c) returned 0x1 [0228.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0228.716] GetFileType (hFile=0x15c) returned 0x1 [0229.201] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", lpFilePart=0x0) returned 0x2b [0229.201] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0229.201] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0229.201] GetFileType (hFile=0x23c) returned 0x1 [0229.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0229.201] GetFileType (hFile=0x23c) returned 0x1 [0229.201] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a8f78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0229.206] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a8f78*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0229.206] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a8f78*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0229.207] ReadFile (in: hFile=0x23c, lpBuffer=0x22a8f78, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22a8f78*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0229.207] CloseHandle (hObject=0x23c) returned 1 [0229.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", lpFilePart=0x0) returned 0x2b [0229.207] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.png")) returned 1 [0229.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.TXT", lpFilePart=0x0) returned 0x2b [0229.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0229.209] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.210] GetFileType (hFile=0x15c) returned 0x1 [0229.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0229.210] GetFileType (hFile=0x15c) returned 0x1 [0229.210] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png", lpFilePart=0x0) returned 0x2b [0229.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0229.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0229.211] GetFileType (hFile=0x15c) returned 0x1 [0229.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0229.211] GetFileType (hFile=0x15c) returned 0x1 [0229.211] WriteFile (in: hFile=0x15c, lpBuffer=0x22b6810*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22b6810*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0229.213] CloseHandle (hObject=0x15c) returned 1 [0229.213] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.vbs", lpFilePart=0x0) returned 0x2b [0229.213] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0229.213] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\visio\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.214] GetFileType (hFile=0x15c) returned 0x1 [0229.214] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0229.214] GetFileType (hFile=0x15c) returned 0x1 [0229.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\VISIO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x57 [0229.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0229.215] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\visio\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.215] GetFileType (hFile=0x15c) returned 0x1 [0229.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0229.215] GetFileType (hFile=0x15c) returned 0x1 [0229.216] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0229.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24 [0229.216] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25 [0229.216] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0229.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0229.217] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0229.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0229.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0229.217] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0229.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc", lpFilePart=0x0) returned 0x24 [0229.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\", lpFilePart=0x0) returned 0x25 [0229.217] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0229.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.218] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.218] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.218] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.218] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.218] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0229.218] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0229.218] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0229.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0229.218] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0229.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", lpFilePart=0x0) returned 0x2d [0229.218] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", dwFileAttributes=0x80) returned 1 [0229.219] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x35 [0229.219] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0229.219] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0229.226] GetFileType (hFile=0x15c) returned 0x1 [0229.226] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0229.226] GetFileType (hFile=0x15c) returned 0x1 [0229.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", lpFilePart=0x0) returned 0x2d [0229.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0229.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0229.698] GetFileType (hFile=0x23c) returned 0x1 [0229.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0229.698] GetFileType (hFile=0x23c) returned 0x1 [0229.698] ReadFile (in: hFile=0x23c, lpBuffer=0x23a8910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a8910*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0229.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23a8910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a8910*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0229.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23a8910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a8910*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0229.703] ReadFile (in: hFile=0x23c, lpBuffer=0x23a8910, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23a8910*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0229.703] CloseHandle (hObject=0x23c) returned 1 [0229.703] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", lpFilePart=0x0) returned 0x2d [0229.703] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.png")) returned 1 [0229.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0229.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d [0229.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e [0229.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0229.705] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0229.705] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0229.706] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0229.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0229.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0229.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0229.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles", lpFilePart=0x0) returned 0x2d [0229.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\", lpFilePart=0x0) returned 0x2e [0229.706] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0229.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0229.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0229.706] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0229.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0229.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0229.708] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Hack.TXT", lpFilePart=0x0) returned 0x36 [0229.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0229.708] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Profiles\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\profiles\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0xffffffffffffffff [0229.710] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ea610) returned 1 [0229.713] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.TXT", lpFilePart=0x0) returned 0x2d [0229.713] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0229.713] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.713] GetFileType (hFile=0x15c) returned 0x1 [0229.713] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0229.713] GetFileType (hFile=0x15c) returned 0x1 [0229.713] WriteFile (in: hFile=0x15c, lpBuffer=0x23beaa8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23beaa8*, lpNumberOfBytesWritten=0x2eddf8*=0x39b, lpOverlapped=0x0) returned 1 [0229.714] CloseHandle (hObject=0x15c) returned 1 [0229.714] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png", lpFilePart=0x0) returned 0x2d [0229.715] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0229.715] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0229.715] GetFileType (hFile=0x15c) returned 0x1 [0229.715] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0229.715] GetFileType (hFile=0x15c) returned 0x1 [0229.715] WriteFile (in: hFile=0x15c, lpBuffer=0x23bfb38*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23bfb38*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0229.716] CloseHandle (hObject=0x15c) returned 1 [0229.716] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.vbs", lpFilePart=0x0) returned 0x2d [0229.716] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0229.716] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.716] GetFileType (hFile=0x15c) returned 0x1 [0229.716] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0229.716] GetFileType (hFile=0x15c) returned 0x1 [0229.716] WriteFile (in: hFile=0x15c, lpBuffer=0x23c3660*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2edd98, lpOverlapped=0x0 | out: lpBuffer=0x23c3660*, lpNumberOfBytesWritten=0x2edd98*=0x13c, lpOverlapped=0x0) returned 1 [0229.717] CloseHandle (hObject=0x15c) returned 1 [0229.717] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\WwanSvc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x59 [0229.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0229.717] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\WwanSvc\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\wwansvc\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.718] GetFileType (hFile=0x15c) returned 0x1 [0229.718] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0229.718] GetFileType (hFile=0x15c) returned 0x1 [0229.718] WriteFile (in: hFile=0x15c, lpBuffer=0x23c6020*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2eddf8, lpOverlapped=0x0 | out: lpBuffer=0x23c6020*, lpNumberOfBytesWritten=0x2eddf8*=0xc6, lpOverlapped=0x0) returned 1 [0229.719] CloseHandle (hObject=0x15c) returned 1 [0229.720] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.TXT", lpFilePart=0x0) returned 0x25 [0229.720] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0229.721] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.721] GetFileType (hFile=0x15c) returned 0x1 [0229.721] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0229.721] GetFileType (hFile=0x15c) returned 0x1 [0229.721] WriteFile (in: hFile=0x15c, lpBuffer=0x23d02a8*, nNumberOfBytesToWrite=0x39b, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23d02a8*, lpNumberOfBytesWritten=0x2ede78*=0x39b, lpOverlapped=0x0) returned 1 [0229.722] CloseHandle (hObject=0x15c) returned 1 [0229.722] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.png", lpFilePart=0x0) returned 0x25 [0229.722] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0229.722] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.png" (normalized: "c:\\users\\all users\\microsoft\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0229.722] GetFileType (hFile=0x15c) returned 0x1 [0229.722] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0229.723] GetFileType (hFile=0x15c) returned 0x1 [0229.723] WriteFile (in: hFile=0x15c, lpBuffer=0x23d1328*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23d1328*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0229.723] CloseHandle (hObject=0x15c) returned 1 [0229.724] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\Hack.vbs", lpFilePart=0x0) returned 0x25 [0229.724] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0229.724] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.724] GetFileType (hFile=0x15c) returned 0x1 [0229.724] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0229.724] GetFileType (hFile=0x15c) returned 0x1 [0229.724] WriteFile (in: hFile=0x15c, lpBuffer=0x23d4e20*, nNumberOfBytesToWrite=0x13c, lpNumberOfBytesWritten=0x2ede18, lpOverlapped=0x0 | out: lpBuffer=0x23d4e20*, lpNumberOfBytesWritten=0x2ede18*=0x13c, lpOverlapped=0x0) returned 1 [0229.725] CloseHandle (hObject=0x15c) returned 1 [0229.725] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x51 [0229.725] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0229.725] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0229.726] GetFileType (hFile=0x15c) returned 0x1 [0229.726] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0229.726] GetFileType (hFile=0x15c) returned 0x1 [0229.726] WriteFile (in: hFile=0x15c, lpBuffer=0x23d77c0*, nNumberOfBytesToWrite=0xc6, lpNumberOfBytesWritten=0x2ede78, lpOverlapped=0x0 | out: lpBuffer=0x23d77c0*, lpNumberOfBytesWritten=0x2ede78*=0xc6, lpOverlapped=0x0) returned 1 [0229.727] CloseHandle (hObject=0x15c) returned 1 [0229.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0229.727] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21 [0229.727] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22 [0229.727] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0229.727] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.728] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.729] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.730] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.731] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0229.732] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0229.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0229.732] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0229.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0229.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help", lpFilePart=0x0) returned 0x21 [0229.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\", lpFilePart=0x0) returned 0x22 [0229.732] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0229.732] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.735] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.736] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.737] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.737] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0229.737] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0229.737] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0229.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0229.737] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0229.737] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.png", lpFilePart=0x0) returned 0x2a [0229.737] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png", dwFileAttributes=0x80) returned 1 [0229.738] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x32 [0229.738] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0229.738] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\microsoft help\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0229.739] GetFileType (hFile=0x15c) returned 0x1 [0229.739] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0229.739] GetFileType (hFile=0x15c) returned 0x1 [0230.254] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.png", lpFilePart=0x0) returned 0x2a [0230.254] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0230.254] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png" (normalized: "c:\\users\\all users\\microsoft help\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0230.255] GetFileType (hFile=0x23c) returned 0x1 [0230.255] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0230.255] GetFileType (hFile=0x23c) returned 0x1 [0230.255] ReadFile (in: hFile=0x23c, lpBuffer=0x22cb300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cb300*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0230.261] ReadFile (in: hFile=0x23c, lpBuffer=0x22cb300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cb300*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0230.261] ReadFile (in: hFile=0x23c, lpBuffer=0x22cb300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cb300*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0230.261] ReadFile (in: hFile=0x23c, lpBuffer=0x22cb300, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22cb300*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0230.262] CloseHandle (hObject=0x23c) returned 1 [0230.262] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.png", lpFilePart=0x0) returned 0x2a [0230.262] DeleteFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png" (normalized: "c:\\users\\all users\\microsoft help\\hack.png")) returned 1 [0230.264] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.TXT", lpFilePart=0x0) returned 0x2a [0230.264] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0230.264] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.TXT" (normalized: "c:\\users\\all users\\microsoft help\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0230.265] GetFileType (hFile=0x15c) returned 0x1 [0230.265] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0230.265] GetFileType (hFile=0x15c) returned 0x1 [0230.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.png", lpFilePart=0x0) returned 0x2a [0230.266] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0230.266] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.png" (normalized: "c:\\users\\all users\\microsoft help\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0230.266] GetFileType (hFile=0x15c) returned 0x1 [0230.266] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0230.266] GetFileType (hFile=0x15c) returned 0x1 [0230.267] WriteFile (in: hFile=0x15c, lpBuffer=0x22d9048*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22d9048*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0230.268] CloseHandle (hObject=0x15c) returned 1 [0230.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\Hack.vbs", lpFilePart=0x0) returned 0x2a [0230.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0230.268] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\Hack.vbs" (normalized: "c:\\users\\all users\\microsoft help\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0230.268] GetFileType (hFile=0x15c) returned 0x1 [0230.268] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0230.269] GetFileType (hFile=0x15c) returned 0x1 [0230.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x56 [0230.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0230.270] CreateFileW (lpFileName="C:\\Users\\All Users\\Microsoft Help\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\microsoft help\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0230.270] GetFileType (hFile=0x15c) returned 0x1 [0230.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0230.270] GetFileType (hFile=0x15c) returned 0x1 [0230.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0230.271] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a [0230.271] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b [0230.271] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.272] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0230.273] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0230.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0230.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0230.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0230.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla", lpFilePart=0x0) returned 0x1a [0230.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\", lpFilePart=0x0) returned 0x1b [0230.273] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0230.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.273] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0230.274] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0230.274] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0230.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0230.274] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0230.274] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x23 [0230.275] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png", dwFileAttributes=0x80) returned 1 [0230.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x2b [0230.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0230.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\mozilla\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0230.276] GetFileType (hFile=0x15c) returned 0x1 [0230.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0230.276] GetFileType (hFile=0x15c) returned 0x1 [0230.776] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x23 [0230.776] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0230.776] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png" (normalized: "c:\\users\\all users\\mozilla\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0230.777] GetFileType (hFile=0x23c) returned 0x1 [0230.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0230.777] GetFileType (hFile=0x23c) returned 0x1 [0230.777] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca340*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0230.783] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca340*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0230.783] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca340*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0230.783] ReadFile (in: hFile=0x23c, lpBuffer=0x23ca340, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23ca340*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0230.783] CloseHandle (hObject=0x23c) returned 1 [0230.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x23 [0230.784] DeleteFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png" (normalized: "c:\\users\\all users\\mozilla\\hack.png")) returned 1 [0230.785] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0230.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f [0230.785] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20 [0230.786] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.786] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0230.786] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0230.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0230.787] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0230.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0230.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs", lpFilePart=0x0) returned 0x1f [0230.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\", lpFilePart=0x0) returned 0x20 [0230.787] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0230.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0230.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0230.788] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0230.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0230.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0230.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", lpFilePart=0x0) returned 0x28 [0230.788] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", dwFileAttributes=0x80) returned 1 [0230.789] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x30 [0230.789] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0230.789] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0230.789] GetFileType (hFile=0x15c) returned 0x1 [0230.789] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0230.789] GetFileType (hFile=0x15c) returned 0x1 [0231.261] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", lpFilePart=0x0) returned 0x28 [0231.261] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0231.261] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0231.261] GetFileType (hFile=0x23c) returned 0x1 [0231.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0231.261] GetFileType (hFile=0x23c) returned 0x1 [0231.261] ReadFile (in: hFile=0x23c, lpBuffer=0x22b5dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b5dc0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0231.266] ReadFile (in: hFile=0x23c, lpBuffer=0x22b5dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b5dc0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0231.267] ReadFile (in: hFile=0x23c, lpBuffer=0x22b5dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b5dc0*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0231.267] ReadFile (in: hFile=0x23c, lpBuffer=0x22b5dc0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22b5dc0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0231.267] CloseHandle (hObject=0x23c) returned 1 [0231.267] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", lpFilePart=0x0) returned 0x28 [0231.267] DeleteFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.png")) returned 1 [0231.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.TXT", lpFilePart=0x0) returned 0x28 [0231.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0231.269] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.TXT" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.269] GetFileType (hFile=0x15c) returned 0x1 [0231.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0231.269] GetFileType (hFile=0x15c) returned 0x1 [0231.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png", lpFilePart=0x0) returned 0x28 [0231.270] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0231.270] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.png" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0231.271] GetFileType (hFile=0x15c) returned 0x1 [0231.271] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0231.271] GetFileType (hFile=0x15c) returned 0x1 [0231.271] WriteFile (in: hFile=0x15c, lpBuffer=0x22c3680*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22c3680*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0231.272] CloseHandle (hObject=0x15c) returned 1 [0231.272] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\Hack.vbs", lpFilePart=0x0) returned 0x28 [0231.272] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0231.272] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\Hack.vbs" (normalized: "c:\\users\\all users\\mozilla\\logs\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.272] GetFileType (hFile=0x15c) returned 0x1 [0231.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0231.272] GetFileType (hFile=0x15c) returned 0x1 [0231.273] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x54 [0231.273] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0231.273] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\logs\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\mozilla\\logs\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.273] GetFileType (hFile=0x15c) returned 0x1 [0231.273] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0231.273] GetFileType (hFile=0x15c) returned 0x1 [0231.274] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.TXT", lpFilePart=0x0) returned 0x23 [0231.274] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0231.274] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.TXT" (normalized: "c:\\users\\all users\\mozilla\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.275] GetFileType (hFile=0x15c) returned 0x1 [0231.275] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0231.275] GetFileType (hFile=0x15c) returned 0x1 [0231.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.png", lpFilePart=0x0) returned 0x23 [0231.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0231.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.png" (normalized: "c:\\users\\all users\\mozilla\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0231.276] GetFileType (hFile=0x15c) returned 0x1 [0231.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0231.276] GetFileType (hFile=0x15c) returned 0x1 [0231.276] WriteFile (in: hFile=0x15c, lpBuffer=0x22d4e30*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x22d4e30*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0231.277] CloseHandle (hObject=0x15c) returned 1 [0231.277] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\Hack.vbs", lpFilePart=0x0) returned 0x23 [0231.277] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0231.277] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\Hack.vbs" (normalized: "c:\\users\\all users\\mozilla\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.278] GetFileType (hFile=0x15c) returned 0x1 [0231.278] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0231.278] GetFileType (hFile=0x15c) returned 0x1 [0231.278] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4f [0231.279] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0231.279] CreateFileW (lpFileName="C:\\Users\\All Users\\Mozilla\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\mozilla\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.279] GetFileType (hFile=0x15c) returned 0x1 [0231.279] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0231.279] GetFileType (hFile=0x15c) returned 0x1 [0231.280] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0231.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19 [0231.280] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a [0231.280] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0231.280] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.280] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.280] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.280] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.281] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.281] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0231.281] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0231.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0231.281] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0231.281] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0231.281] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle", lpFilePart=0x0) returned 0x19 [0231.281] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\", lpFilePart=0x0) returned 0x1a [0231.281] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Oracle\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0231.281] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.281] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.281] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.282] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.282] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.282] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0231.282] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0231.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0231.282] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0231.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.png", lpFilePart=0x0) returned 0x22 [0231.282] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png", dwFileAttributes=0x80) returned 1 [0231.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x2a [0231.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0231.283] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\oracle\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0231.285] GetFileType (hFile=0x15c) returned 0x1 [0231.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0231.285] GetFileType (hFile=0x15c) returned 0x1 [0231.763] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.png", lpFilePart=0x0) returned 0x22 [0231.763] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0231.763] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png" (normalized: "c:\\users\\all users\\oracle\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0231.763] GetFileType (hFile=0x23c) returned 0x1 [0231.763] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0231.764] GetFileType (hFile=0x23c) returned 0x1 [0231.764] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3da0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c3da0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0231.768] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3da0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c3da0*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0231.769] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3da0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c3da0*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0231.769] ReadFile (in: hFile=0x23c, lpBuffer=0x23c3da0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x23c3da0*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0231.769] CloseHandle (hObject=0x23c) returned 1 [0231.769] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.png", lpFilePart=0x0) returned 0x22 [0231.769] DeleteFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png" (normalized: "c:\\users\\all users\\oracle\\hack.png")) returned 1 [0231.773] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.TXT", lpFilePart=0x0) returned 0x22 [0231.773] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0231.773] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.TXT" (normalized: "c:\\users\\all users\\oracle\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.773] GetFileType (hFile=0x15c) returned 0x1 [0231.773] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0231.773] GetFileType (hFile=0x15c) returned 0x1 [0231.774] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.png", lpFilePart=0x0) returned 0x22 [0231.774] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0231.774] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.png" (normalized: "c:\\users\\all users\\oracle\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0231.774] GetFileType (hFile=0x15c) returned 0x1 [0231.774] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede00) returned 1 [0231.774] GetFileType (hFile=0x15c) returned 0x1 [0231.774] WriteFile (in: hFile=0x15c, lpBuffer=0x23d15f8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edfb8, lpOverlapped=0x0 | out: lpBuffer=0x23d15f8*, lpNumberOfBytesWritten=0x2edfb8*=0x2337, lpOverlapped=0x0) returned 1 [0231.775] CloseHandle (hObject=0x15c) returned 1 [0231.775] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\Hack.vbs", lpFilePart=0x0) returned 0x22 [0231.775] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0231.775] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\Hack.vbs" (normalized: "c:\\users\\all users\\oracle\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.776] GetFileType (hFile=0x15c) returned 0x1 [0231.776] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0231.776] GetFileType (hFile=0x15c) returned 0x1 [0231.777] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Oracle\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed8f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Oracle\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x4e [0231.777] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddd0) returned 1 [0231.777] CreateFileW (lpFileName="C:\\Users\\All Users\\Oracle\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\oracle\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0231.777] GetFileType (hFile=0x15c) returned 0x1 [0231.777] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd40) returned 1 [0231.777] GetFileType (hFile=0x15c) returned 0x1 [0231.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0231.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0231.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21 [0231.778] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0231.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0231.781] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0231.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0231.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0231.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf90) returned 1 [0231.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache", nBufferLength=0x105, lpBuffer=0x2eda80, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache", lpFilePart=0x0) returned 0x20 [0231.782] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\", nBufferLength=0x105, lpBuffer=0x2eda20, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\", lpFilePart=0x0) returned 0x21 [0231.782] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\*", lpFindFileData=0x2edc30 | out: lpFindFileData=0x2edc30) returned 0x1e406b0 [0231.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.783] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.783] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.783] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.783] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.784] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 1 [0231.785] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc80 | out: lpFindFileData=0x2edc80) returned 0 [0231.786] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0231.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edee0) returned 1 [0231.786] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edea0) returned 1 [0231.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edb30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.png", lpFilePart=0x0) returned 0x29 [0231.786] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png", dwFileAttributes=0x80) returned 1 [0231.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x31 [0231.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0231.787] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0231.788] GetFileType (hFile=0x15c) returned 0x1 [0231.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0231.788] GetFileType (hFile=0x15c) returned 0x1 [0232.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed950, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.png", lpFilePart=0x0) returned 0x29 [0232.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede30) returned 1 [0232.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0232.276] GetFileType (hFile=0x23c) returned 0x1 [0232.277] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0232.277] GetFileType (hFile=0x23c) returned 0x1 [0232.277] ReadFile (in: hFile=0x23c, lpBuffer=0x22c7d00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c7d00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0232.278] ReadFile (in: hFile=0x23c, lpBuffer=0x22c7d00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c7d00*, lpNumberOfBytesRead=0x2edf68*=0x1000, lpOverlapped=0x0) returned 1 [0232.281] ReadFile (in: hFile=0x23c, lpBuffer=0x22c7d00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c7d00*, lpNumberOfBytesRead=0x2edf68*=0x337, lpOverlapped=0x0) returned 1 [0232.282] ReadFile (in: hFile=0x23c, lpBuffer=0x22c7d00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edf68, lpOverlapped=0x0 | out: lpBuffer=0x22c7d00*, lpNumberOfBytesRead=0x2edf68*=0x0, lpOverlapped=0x0) returned 1 [0232.282] CloseHandle (hObject=0x23c) returned 1 [0232.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda60, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\Hack.png", lpFilePart=0x0) returned 0x29 [0232.282] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\hack.png")) returned 1 [0232.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0232.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x49 [0232.284] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x4a [0232.284] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0232.285] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0232.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0232.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0232.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0232.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460", lpFilePart=0x0) returned 0x49 [0232.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\", lpFilePart=0x0) returned 0x4a [0232.285] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0232.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0232.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0232.286] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0232.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0232.286] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0232.286] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", lpFilePart=0x0) returned 0x52 [0232.286] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", dwFileAttributes=0x80) returned 1 [0232.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x5a [0232.287] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0232.287] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0232.288] GetFileType (hFile=0x15c) returned 0x1 [0232.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0232.288] GetFileType (hFile=0x15c) returned 0x1 [0232.759] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", lpFilePart=0x0) returned 0x52 [0232.759] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0232.759] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0232.760] GetFileType (hFile=0x23c) returned 0x1 [0232.760] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0232.760] GetFileType (hFile=0x23c) returned 0x1 [0232.760] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4710, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b4710*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0232.765] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4710, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b4710*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0232.765] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4710, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b4710*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0232.765] ReadFile (in: hFile=0x23c, lpBuffer=0x23b4710, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x23b4710*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0232.765] CloseHandle (hObject=0x23c) returned 1 [0232.766] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", lpFilePart=0x0) returned 0x52 [0232.766] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.png")) returned 1 [0232.767] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0232.767] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x52 [0232.767] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x53 [0232.767] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.768] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0232.768] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0232.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0232.768] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0232.768] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0232.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages", lpFilePart=0x0) returned 0x52 [0232.768] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\", lpFilePart=0x0) returned 0x53 [0232.769] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0232.769] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0232.770] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0232.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0232.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0232.770] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0232.770] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0232.771] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0232.771] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0232.771] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0232.771] GetFileType (hFile=0x15c) returned 0x1 [0232.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0232.771] GetFileType (hFile=0x15c) returned 0x1 [0233.260] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0233.260] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0233.260] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0233.261] GetFileType (hFile=0x23c) returned 0x1 [0233.261] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0233.261] GetFileType (hFile=0x23c) returned 0x1 [0233.261] ReadFile (in: hFile=0x23c, lpBuffer=0x22743d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22743d8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0233.265] ReadFile (in: hFile=0x23c, lpBuffer=0x22743d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22743d8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0233.266] ReadFile (in: hFile=0x23c, lpBuffer=0x22743d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22743d8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0233.266] ReadFile (in: hFile=0x23c, lpBuffer=0x22743d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22743d8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0233.266] CloseHandle (hObject=0x23c) returned 1 [0233.266] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0233.266] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.png")) returned 1 [0233.268] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0233.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0233.268] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0233.268] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0233.268] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.268] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.268] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.268] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.268] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.269] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.269] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0233.269] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0233.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0233.269] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0233.269] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0233.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0233.269] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0233.269] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0233.269] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.269] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.269] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.270] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.270] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.270] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0233.270] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0233.270] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0233.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0233.270] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0233.270] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0233.270] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", dwFileAttributes=0x80) returned 1 [0233.271] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x69 [0233.271] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0233.271] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0233.272] GetFileType (hFile=0x15c) returned 0x1 [0233.272] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0233.272] GetFileType (hFile=0x15c) returned 0x1 [0233.770] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0233.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0233.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0233.770] GetFileType (hFile=0x23c) returned 0x1 [0233.771] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0233.771] GetFileType (hFile=0x23c) returned 0x1 [0233.771] ReadFile (in: hFile=0x23c, lpBuffer=0x2363bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2363bf8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0233.776] ReadFile (in: hFile=0x23c, lpBuffer=0x2363bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2363bf8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0233.776] ReadFile (in: hFile=0x23c, lpBuffer=0x2363bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2363bf8*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0233.776] ReadFile (in: hFile=0x23c, lpBuffer=0x2363bf8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2363bf8*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0233.776] CloseHandle (hObject=0x23c) returned 1 [0233.776] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0233.776] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.png")) returned 1 [0233.778] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0233.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c [0233.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d [0233.778] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x1e406b0 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.778] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0233.779] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0233.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0233.779] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0233.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0233.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c [0233.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d [0233.779] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x1e406b0 [0233.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.779] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0233.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0233.780] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0233.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0233.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0233.780] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0233.780] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", dwFileAttributes=0x80) returned 1 [0233.781] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6d [0233.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0233.781] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0233.782] GetFileType (hFile=0x15c) returned 0x1 [0233.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0233.782] GetFileType (hFile=0x15c) returned 0x1 [0234.316] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0234.316] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0234.317] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0234.317] GetFileType (hFile=0x23c) returned 0x1 [0234.317] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0234.317] GetFileType (hFile=0x23c) returned 0x1 [0234.317] ReadFile (in: hFile=0x23c, lpBuffer=0x2253898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2253898*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0234.321] ReadFile (in: hFile=0x23c, lpBuffer=0x2253898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2253898*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0234.322] ReadFile (in: hFile=0x23c, lpBuffer=0x2253898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2253898*, lpNumberOfBytesRead=0x2edd68*=0x337, lpOverlapped=0x0) returned 1 [0234.322] ReadFile (in: hFile=0x23c, lpBuffer=0x2253898, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2253898*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0234.322] CloseHandle (hObject=0x23c) returned 1 [0234.323] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0234.323] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.png")) returned 1 [0234.324] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0234.324] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0234.324] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.325] GetFileType (hFile=0x15c) returned 0x1 [0234.325] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0234.325] GetFileType (hFile=0x15c) returned 0x1 [0234.325] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0234.325] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0234.325] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0234.326] GetFileType (hFile=0x15c) returned 0x1 [0234.326] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0234.326] GetFileType (hFile=0x15c) returned 0x1 [0234.326] WriteFile (in: hFile=0x15c, lpBuffer=0x2261338*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2261338*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0234.327] CloseHandle (hObject=0x15c) returned 1 [0234.327] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0234.327] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0234.327] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.327] GetFileType (hFile=0x15c) returned 0x1 [0234.327] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0234.327] GetFileType (hFile=0x15c) returned 0x1 [0234.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0234.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0234.328] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\x64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.328] GetFileType (hFile=0x15c) returned 0x1 [0234.328] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0234.328] GetFileType (hFile=0x15c) returned 0x1 [0234.329] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0234.329] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0234.329] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.329] GetFileType (hFile=0x15c) returned 0x1 [0234.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0234.330] GetFileType (hFile=0x15c) returned 0x1 [0234.330] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0234.330] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0234.330] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0234.331] GetFileType (hFile=0x15c) returned 0x1 [0234.331] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0234.331] GetFileType (hFile=0x15c) returned 0x1 [0234.331] WriteFile (in: hFile=0x15c, lpBuffer=0x2272ec0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2272ec0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0234.332] CloseHandle (hObject=0x15c) returned 1 [0234.332] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0234.332] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0234.332] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.332] GetFileType (hFile=0x15c) returned 0x1 [0234.332] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0234.332] GetFileType (hFile=0x15c) returned 0x1 [0234.333] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0234.333] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0234.333] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\patch\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.334] GetFileType (hFile=0x15c) returned 0x1 [0234.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0234.334] GetFileType (hFile=0x15c) returned 0x1 [0234.334] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0234.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0234.335] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.335] GetFileType (hFile=0x15c) returned 0x1 [0234.335] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0234.335] GetFileType (hFile=0x15c) returned 0x1 [0234.336] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0234.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0234.336] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0234.336] GetFileType (hFile=0x15c) returned 0x1 [0234.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0234.336] GetFileType (hFile=0x15c) returned 0x1 [0234.336] WriteFile (in: hFile=0x15c, lpBuffer=0x22849f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22849f0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0234.337] CloseHandle (hObject=0x15c) returned 1 [0234.337] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0234.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0234.338] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.338] GetFileType (hFile=0x15c) returned 0x1 [0234.338] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0234.338] GetFileType (hFile=0x15c) returned 0x1 [0234.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0234.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0234.339] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.339] GetFileType (hFile=0x15c) returned 0x1 [0234.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0234.339] GetFileType (hFile=0x15c) returned 0x1 [0234.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0234.340] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0234.340] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.340] GetFileType (hFile=0x15c) returned 0x1 [0234.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0234.340] GetFileType (hFile=0x15c) returned 0x1 [0234.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png", lpFilePart=0x0) returned 0x52 [0234.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0234.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0234.341] GetFileType (hFile=0x15c) returned 0x1 [0234.341] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0234.342] GetFileType (hFile=0x15c) returned 0x1 [0234.342] WriteFile (in: hFile=0x15c, lpBuffer=0x22964a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22964a0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0234.343] CloseHandle (hObject=0x15c) returned 1 [0234.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0234.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0234.343] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.344] GetFileType (hFile=0x15c) returned 0x1 [0234.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0234.344] GetFileType (hFile=0x15c) returned 0x1 [0234.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0234.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0234.345] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\42D5BEC7DDFBD49E76467529CBC2868987BF8460\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\42d5bec7ddfbd49e76467529cbc2868987bf8460\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0234.345] GetFileType (hFile=0x15c) returned 0x1 [0234.345] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0234.345] GetFileType (hFile=0x15c) returned 0x1 [0234.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0234.346] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x49 [0234.346] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x4a [0234.346] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0234.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.346] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0234.347] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0234.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0234.347] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0234.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0234.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D", lpFilePart=0x0) returned 0x49 [0234.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\", lpFilePart=0x0) returned 0x4a [0234.347] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0234.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.347] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0234.348] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0234.348] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0234.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0234.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0234.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", lpFilePart=0x0) returned 0x52 [0234.349] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", dwFileAttributes=0x80) returned 1 [0234.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x5a [0234.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0234.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0234.350] GetFileType (hFile=0x15c) returned 0x1 [0234.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0234.350] GetFileType (hFile=0x15c) returned 0x1 [0234.828] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", lpFilePart=0x0) returned 0x52 [0234.829] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0234.829] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0234.829] GetFileType (hFile=0x23c) returned 0x1 [0234.829] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0234.829] GetFileType (hFile=0x23c) returned 0x1 [0234.829] ReadFile (in: hFile=0x23c, lpBuffer=0x2389748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2389748*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0234.834] ReadFile (in: hFile=0x23c, lpBuffer=0x2389748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2389748*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0234.834] ReadFile (in: hFile=0x23c, lpBuffer=0x2389748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2389748*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0234.834] ReadFile (in: hFile=0x23c, lpBuffer=0x2389748, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2389748*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0234.834] CloseHandle (hObject=0x23c) returned 1 [0234.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", lpFilePart=0x0) returned 0x52 [0234.835] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.png")) returned 1 [0234.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0234.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x52 [0234.836] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x53 [0234.836] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0234.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.837] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.837] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.837] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.837] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.837] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.837] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0234.837] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0234.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0234.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0234.837] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0234.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages", lpFilePart=0x0) returned 0x52 [0234.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\", lpFilePart=0x0) returned 0x53 [0234.837] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0234.838] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0234.838] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0234.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0234.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0234.839] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0234.839] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0234.841] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0234.841] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0234.841] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0234.842] GetFileType (hFile=0x15c) returned 0x1 [0234.842] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0234.842] GetFileType (hFile=0x15c) returned 0x1 [0235.333] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0235.334] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0235.334] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0235.334] GetFileType (hFile=0x23c) returned 0x1 [0235.334] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0235.334] GetFileType (hFile=0x23c) returned 0x1 [0235.334] ReadFile (in: hFile=0x23c, lpBuffer=0x2278dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2278dd8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0235.339] ReadFile (in: hFile=0x23c, lpBuffer=0x2278dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2278dd8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0235.339] ReadFile (in: hFile=0x23c, lpBuffer=0x2278dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2278dd8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0235.340] ReadFile (in: hFile=0x23c, lpBuffer=0x2278dd8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2278dd8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0235.340] CloseHandle (hObject=0x23c) returned 1 [0235.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0235.340] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.png")) returned 1 [0235.342] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0235.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0235.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0235.342] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0235.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.342] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0235.343] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0235.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0235.343] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0235.343] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0235.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch", lpFilePart=0x0) returned 0x58 [0235.343] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\", lpFilePart=0x0) returned 0x59 [0235.343] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0235.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.343] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0235.344] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0235.344] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0235.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0235.344] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0235.344] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0235.344] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", dwFileAttributes=0x80) returned 1 [0235.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x69 [0235.345] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0235.345] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0235.346] GetFileType (hFile=0x15c) returned 0x1 [0235.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0235.346] GetFileType (hFile=0x15c) returned 0x1 [0235.826] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0235.826] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0235.826] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0235.827] GetFileType (hFile=0x23c) returned 0x1 [0235.827] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0235.827] GetFileType (hFile=0x23c) returned 0x1 [0235.827] ReadFile (in: hFile=0x23c, lpBuffer=0x23685f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23685f8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0235.832] ReadFile (in: hFile=0x23c, lpBuffer=0x23685f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23685f8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0235.832] ReadFile (in: hFile=0x23c, lpBuffer=0x23685f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23685f8*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0235.832] ReadFile (in: hFile=0x23c, lpBuffer=0x23685f8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23685f8*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0235.832] CloseHandle (hObject=0x23c) returned 1 [0235.832] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0235.832] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.png")) returned 1 [0235.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0235.834] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c [0235.834] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d [0235.834] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x1e406b0 [0235.834] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.834] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.834] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.835] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.835] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.835] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.835] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0235.835] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0235.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0235.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0235.835] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0235.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", nBufferLength=0x105, lpBuffer=0x2ed880, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64", lpFilePart=0x0) returned 0x5c [0235.835] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", nBufferLength=0x105, lpBuffer=0x2ed820, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\", lpFilePart=0x0) returned 0x5d [0235.835] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\*", lpFindFileData=0x2eda30 | out: lpFindFileData=0x2eda30) returned 0x1e406b0 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 1 [0235.836] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2eda80 | out: lpFindFileData=0x2eda80) returned 0 [0235.836] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0235.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edce0) returned 1 [0235.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0235.837] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0235.837] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", dwFileAttributes=0x80) returned 1 [0235.838] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6d [0235.838] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0235.838] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0235.838] GetFileType (hFile=0x15c) returned 0x1 [0235.838] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0235.838] GetFileType (hFile=0x15c) returned 0x1 [0236.335] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed750, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0236.336] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc30) returned 1 [0236.336] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0236.336] GetFileType (hFile=0x23c) returned 0x1 [0236.336] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edba0) returned 1 [0236.336] GetFileType (hFile=0x23c) returned 0x1 [0236.336] ReadFile (in: hFile=0x23c, lpBuffer=0x2258298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2258298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0236.341] ReadFile (in: hFile=0x23c, lpBuffer=0x2258298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2258298*, lpNumberOfBytesRead=0x2edd68*=0x1000, lpOverlapped=0x0) returned 1 [0236.341] ReadFile (in: hFile=0x23c, lpBuffer=0x2258298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2258298*, lpNumberOfBytesRead=0x2edd68*=0x337, lpOverlapped=0x0) returned 1 [0236.342] ReadFile (in: hFile=0x23c, lpBuffer=0x2258298, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edd68, lpOverlapped=0x0 | out: lpBuffer=0x2258298*, lpNumberOfBytesRead=0x2edd68*=0x0, lpOverlapped=0x0) returned 1 [0236.342] CloseHandle (hObject=0x23c) returned 1 [0236.342] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed860, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0236.342] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.png")) returned 1 [0236.346] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0236.346] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0236.346] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.346] GetFileType (hFile=0x15c) returned 0x1 [0236.346] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0236.346] GetFileType (hFile=0x15c) returned 0x1 [0236.347] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png", lpFilePart=0x0) returned 0x65 [0236.347] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc90) returned 1 [0236.347] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0236.347] GetFileType (hFile=0x15c) returned 0x1 [0236.348] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc00) returned 1 [0236.348] GetFileType (hFile=0x15c) returned 0x1 [0236.348] WriteFile (in: hFile=0x15c, lpBuffer=0x2265d38*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2eddb8, lpOverlapped=0x0 | out: lpBuffer=0x2265d38*, lpNumberOfBytesWritten=0x2eddb8*=0x2337, lpOverlapped=0x0) returned 1 [0236.348] CloseHandle (hObject=0x15c) returned 1 [0236.349] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0236.349] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0236.349] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.349] GetFileType (hFile=0x15c) returned 0x1 [0236.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0236.349] GetFileType (hFile=0x15c) returned 0x1 [0236.350] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed6f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0236.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edbd0) returned 1 [0236.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\x64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\x64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.350] GetFileType (hFile=0x15c) returned 0x1 [0236.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edb40) returned 1 [0236.350] GetFileType (hFile=0x15c) returned 0x1 [0236.351] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.TXT", lpFilePart=0x0) returned 0x61 [0236.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0236.351] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.351] GetFileType (hFile=0x15c) returned 0x1 [0236.351] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0236.351] GetFileType (hFile=0x15c) returned 0x1 [0236.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png", lpFilePart=0x0) returned 0x61 [0236.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0236.352] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0236.352] GetFileType (hFile=0x15c) returned 0x1 [0236.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0236.352] GetFileType (hFile=0x15c) returned 0x1 [0236.353] WriteFile (in: hFile=0x15c, lpBuffer=0x22778c0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x22778c0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0236.353] CloseHandle (hObject=0x15c) returned 1 [0236.353] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.vbs", lpFilePart=0x0) returned 0x61 [0236.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0236.354] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.354] GetFileType (hFile=0x15c) returned 0x1 [0236.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0236.354] GetFileType (hFile=0x15c) returned 0x1 [0236.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x8d [0236.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0236.355] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Patch\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\patch\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.355] GetFileType (hFile=0x15c) returned 0x1 [0236.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0236.355] GetFileType (hFile=0x15c) returned 0x1 [0236.356] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0236.356] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0236.356] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.356] GetFileType (hFile=0x15c) returned 0x1 [0236.356] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0236.356] GetFileType (hFile=0x15c) returned 0x1 [0236.357] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png", lpFilePart=0x0) returned 0x5b [0236.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0236.357] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0236.357] GetFileType (hFile=0x15c) returned 0x1 [0236.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0236.357] GetFileType (hFile=0x15c) returned 0x1 [0236.357] WriteFile (in: hFile=0x15c, lpBuffer=0x22893f0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22893f0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0236.358] CloseHandle (hObject=0x15c) returned 1 [0236.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0236.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0236.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.359] GetFileType (hFile=0x15c) returned 0x1 [0236.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0236.359] GetFileType (hFile=0x15c) returned 0x1 [0236.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0236.360] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0236.360] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.360] GetFileType (hFile=0x15c) returned 0x1 [0236.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0236.360] GetFileType (hFile=0x15c) returned 0x1 [0236.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.TXT", lpFilePart=0x0) returned 0x52 [0236.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0236.361] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.361] GetFileType (hFile=0x15c) returned 0x1 [0236.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0236.361] GetFileType (hFile=0x15c) returned 0x1 [0236.362] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png", lpFilePart=0x0) returned 0x52 [0236.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0236.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0236.363] GetFileType (hFile=0x15c) returned 0x1 [0236.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0236.363] GetFileType (hFile=0x15c) returned 0x1 [0236.363] WriteFile (in: hFile=0x15c, lpBuffer=0x229aea0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x229aea0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0236.364] CloseHandle (hObject=0x15c) returned 1 [0236.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.vbs", lpFilePart=0x0) returned 0x52 [0236.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0236.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.365] GetFileType (hFile=0x15c) returned 0x1 [0236.365] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0236.365] GetFileType (hFile=0x15c) returned 0x1 [0236.366] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7e [0236.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0236.366] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\54050A5F8AE7F0C56E553F0090146C17A1D2BF8D\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\54050a5f8ae7f0c56e553f0090146c17a1d2bf8d\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0236.366] GetFileType (hFile=0x15c) returned 0x1 [0236.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0236.366] GetFileType (hFile=0x15c) returned 0x1 [0236.367] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0236.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52 [0236.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0236.367] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.368] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0236.369] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0236.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0236.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0236.369] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0236.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005", lpFilePart=0x0) returned 0x52 [0236.369] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0236.369] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0236.369] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.369] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.370] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.370] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.370] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.370] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0236.370] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0236.371] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0236.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0236.371] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0236.371] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0236.371] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", dwFileAttributes=0x80) returned 1 [0236.372] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0236.372] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0236.372] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0236.373] GetFileType (hFile=0x15c) returned 0x1 [0236.373] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0236.373] GetFileType (hFile=0x15c) returned 0x1 [0236.858] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0236.858] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0236.858] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0236.858] GetFileType (hFile=0x23c) returned 0x1 [0236.858] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0236.858] GetFileType (hFile=0x23c) returned 0x1 [0236.859] ReadFile (in: hFile=0x23c, lpBuffer=0x238e4d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x238e4d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0236.863] ReadFile (in: hFile=0x23c, lpBuffer=0x238e4d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x238e4d8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0236.864] ReadFile (in: hFile=0x23c, lpBuffer=0x238e4d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x238e4d8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0236.864] ReadFile (in: hFile=0x23c, lpBuffer=0x238e4d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x238e4d8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0236.864] CloseHandle (hObject=0x23c) returned 1 [0236.864] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0236.864] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.png")) returned 1 [0236.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0236.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0236.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0236.865] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.866] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0236.866] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0236.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0236.867] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0236.867] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0236.867] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0236.867] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0236.867] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0236.867] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.867] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.867] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.867] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.867] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.868] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0236.868] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0236.868] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0236.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0236.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0236.868] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0236.868] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0236.869] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0236.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0236.869] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0236.869] GetFileType (hFile=0x15c) returned 0x1 [0236.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0236.870] GetFileType (hFile=0x15c) returned 0x1 [0237.350] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0237.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0237.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0237.350] GetFileType (hFile=0x23c) returned 0x1 [0237.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0237.350] GetFileType (hFile=0x23c) returned 0x1 [0237.351] ReadFile (in: hFile=0x23c, lpBuffer=0x227e0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227e0a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0237.354] ReadFile (in: hFile=0x23c, lpBuffer=0x227e0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227e0a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0237.356] ReadFile (in: hFile=0x23c, lpBuffer=0x227e0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227e0a8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0237.356] ReadFile (in: hFile=0x23c, lpBuffer=0x227e0a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227e0a8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0237.356] CloseHandle (hObject=0x23c) returned 1 [0237.356] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0237.356] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.png")) returned 1 [0237.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0237.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0237.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0237.358] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0237.358] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.358] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.358] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.358] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.358] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.359] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.359] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.359] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0237.359] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0237.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0237.359] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0237.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0237.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0237.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0237.359] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0237.359] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.359] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.360] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.360] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.360] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.360] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.360] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0237.360] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0237.360] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0237.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0237.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0237.360] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0237.360] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", dwFileAttributes=0x80) returned 1 [0237.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x81 [0237.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0237.361] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0237.362] GetFileType (hFile=0x15c) returned 0x1 [0237.362] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0237.362] GetFileType (hFile=0x15c) returned 0x1 [0237.849] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0237.849] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0237.849] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0237.850] GetFileType (hFile=0x23c) returned 0x1 [0237.850] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0237.850] GetFileType (hFile=0x23c) returned 0x1 [0237.850] ReadFile (in: hFile=0x23c, lpBuffer=0x236ebf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ebf0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0237.856] ReadFile (in: hFile=0x23c, lpBuffer=0x236ebf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ebf0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0237.856] ReadFile (in: hFile=0x23c, lpBuffer=0x236ebf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ebf0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0237.856] ReadFile (in: hFile=0x23c, lpBuffer=0x236ebf0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ebf0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0237.856] CloseHandle (hObject=0x23c) returned 1 [0237.856] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0237.857] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.png")) returned 1 [0237.860] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", lpFilePart=0x0) returned 0x79 [0237.860] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0237.860] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.860] GetFileType (hFile=0x15c) returned 0x1 [0237.860] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0237.860] GetFileType (hFile=0x15c) returned 0x1 [0237.861] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0237.861] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0237.861] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0237.862] GetFileType (hFile=0x15c) returned 0x1 [0237.862] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0237.862] GetFileType (hFile=0x15c) returned 0x1 [0237.862] WriteFile (in: hFile=0x15c, lpBuffer=0x237c730*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x237c730*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0237.863] CloseHandle (hObject=0x15c) returned 1 [0237.863] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", lpFilePart=0x0) returned 0x79 [0237.863] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0237.863] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.863] GetFileType (hFile=0x15c) returned 0x1 [0237.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0237.863] GetFileType (hFile=0x15c) returned 0x1 [0237.864] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa5 [0237.864] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0237.864] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\vcruntimeminimum_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.864] GetFileType (hFile=0x15c) returned 0x1 [0237.864] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0237.864] GetFileType (hFile=0x15c) returned 0x1 [0237.865] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0237.865] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0237.865] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.865] GetFileType (hFile=0x15c) returned 0x1 [0237.865] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0237.865] GetFileType (hFile=0x15c) returned 0x1 [0237.866] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0237.866] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0237.866] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0237.866] GetFileType (hFile=0x15c) returned 0x1 [0237.866] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0237.866] GetFileType (hFile=0x15c) returned 0x1 [0237.867] WriteFile (in: hFile=0x15c, lpBuffer=0x238e398*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x238e398*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0237.867] CloseHandle (hObject=0x15c) returned 1 [0237.868] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0237.868] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0237.868] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.868] GetFileType (hFile=0x15c) returned 0x1 [0237.868] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0237.868] GetFileType (hFile=0x15c) returned 0x1 [0237.869] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0237.869] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0237.869] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.869] GetFileType (hFile=0x15c) returned 0x1 [0237.869] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0237.869] GetFileType (hFile=0x15c) returned 0x1 [0237.870] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0237.870] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0237.870] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.870] GetFileType (hFile=0x15c) returned 0x1 [0237.870] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0237.870] GetFileType (hFile=0x15c) returned 0x1 [0237.871] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0237.871] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0237.871] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0237.871] GetFileType (hFile=0x15c) returned 0x1 [0237.871] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0237.871] GetFileType (hFile=0x15c) returned 0x1 [0237.871] WriteFile (in: hFile=0x15c, lpBuffer=0x239fef0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x239fef0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0237.872] CloseHandle (hObject=0x15c) returned 1 [0237.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0237.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0237.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.873] GetFileType (hFile=0x15c) returned 0x1 [0237.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0237.873] GetFileType (hFile=0x15c) returned 0x1 [0237.873] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0237.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0237.874] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{13A4EE12-23EA-3371-91EE-EFB36DDFFF3E}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{13a4ee12-23ea-3371-91ee-efb36ddfff3e}v12.0.21005\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0237.874] GetFileType (hFile=0x15c) returned 0x1 [0237.874] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0237.874] GetFileType (hFile=0x15c) returned 0x1 [0237.875] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0237.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47 [0237.875] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x48 [0237.875] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0237.875] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.875] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.875] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.875] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.875] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.876] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.876] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.876] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0237.876] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0237.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0237.876] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0237.876] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0237.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}", lpFilePart=0x0) returned 0x47 [0237.876] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\", lpFilePart=0x0) returned 0x48 [0237.876] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0237.876] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.876] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.877] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.877] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.877] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.877] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.877] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0237.877] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0237.877] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0237.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0237.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0237.877] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0237.878] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", dwFileAttributes=0x80) returned 1 [0237.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x58 [0237.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0237.878] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0237.879] GetFileType (hFile=0x15c) returned 0x1 [0237.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0237.879] GetFileType (hFile=0x15c) returned 0x1 [0238.368] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0238.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0238.368] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0238.368] GetFileType (hFile=0x23c) returned 0x1 [0238.368] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0238.368] GetFileType (hFile=0x23c) returned 0x1 [0238.369] ReadFile (in: hFile=0x23c, lpBuffer=0x2293778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293778*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0238.372] ReadFile (in: hFile=0x23c, lpBuffer=0x2293778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293778*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0238.374] ReadFile (in: hFile=0x23c, lpBuffer=0x2293778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293778*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0238.374] ReadFile (in: hFile=0x23c, lpBuffer=0x2293778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293778*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0238.374] CloseHandle (hObject=0x23c) returned 1 [0238.374] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0238.374] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.png")) returned 1 [0238.375] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0238.375] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0238.376] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0238.376] GetFileType (hFile=0x15c) returned 0x1 [0238.376] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0238.376] GetFileType (hFile=0x15c) returned 0x1 [0238.377] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0238.377] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0238.377] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0238.377] GetFileType (hFile=0x15c) returned 0x1 [0238.377] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0238.377] GetFileType (hFile=0x15c) returned 0x1 [0238.377] WriteFile (in: hFile=0x15c, lpBuffer=0x22a11a0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22a11a0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0238.378] CloseHandle (hObject=0x15c) returned 1 [0238.378] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0238.378] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0238.378] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0238.378] GetFileType (hFile=0x15c) returned 0x1 [0238.378] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0238.378] GetFileType (hFile=0x15c) returned 0x1 [0238.379] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0238.379] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0238.379] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0238.380] GetFileType (hFile=0x15c) returned 0x1 [0238.380] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0238.380] GetFileType (hFile=0x15c) returned 0x1 [0238.381] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0238.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x52 [0238.381] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0238.381] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0238.381] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.381] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.381] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.382] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.382] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.382] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.382] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0238.382] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0238.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0238.382] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0238.382] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0238.382] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030", lpFilePart=0x0) returned 0x52 [0238.382] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0238.382] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0238.383] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0238.384] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0238.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0238.384] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0238.384] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0238.384] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", dwFileAttributes=0x80) returned 1 [0238.385] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0238.385] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0238.385] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0238.385] GetFileType (hFile=0x15c) returned 0x1 [0238.385] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0238.385] GetFileType (hFile=0x15c) returned 0x1 [0238.907] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0238.907] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0238.907] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0238.907] GetFileType (hFile=0x23c) returned 0x1 [0238.907] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0238.907] GetFileType (hFile=0x23c) returned 0x1 [0238.907] ReadFile (in: hFile=0x23c, lpBuffer=0x2394120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2394120*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0238.912] ReadFile (in: hFile=0x23c, lpBuffer=0x2394120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2394120*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0238.913] ReadFile (in: hFile=0x23c, lpBuffer=0x2394120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2394120*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0238.913] ReadFile (in: hFile=0x23c, lpBuffer=0x2394120, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2394120*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0238.913] CloseHandle (hObject=0x23c) returned 1 [0238.915] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0238.915] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.png")) returned 1 [0238.916] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0238.916] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0238.916] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0238.916] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0238.916] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.916] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.917] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.917] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.917] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.917] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.917] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0238.917] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0238.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0238.917] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0238.917] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0238.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0238.917] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0238.917] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0238.918] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.918] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.918] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.918] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.918] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.918] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0238.919] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0238.919] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0238.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0238.919] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0238.919] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0238.919] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0238.920] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0238.920] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0238.920] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0238.920] GetFileType (hFile=0x15c) returned 0x1 [0238.920] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0238.920] GetFileType (hFile=0x15c) returned 0x1 [0239.387] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0239.387] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0239.387] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0239.387] GetFileType (hFile=0x23c) returned 0x1 [0239.388] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0239.388] GetFileType (hFile=0x23c) returned 0x1 [0239.388] ReadFile (in: hFile=0x23c, lpBuffer=0x22833d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22833d8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0239.393] ReadFile (in: hFile=0x23c, lpBuffer=0x22833d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22833d8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0239.393] ReadFile (in: hFile=0x23c, lpBuffer=0x22833d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22833d8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0239.394] ReadFile (in: hFile=0x23c, lpBuffer=0x22833d8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22833d8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0239.394] CloseHandle (hObject=0x23c) returned 1 [0239.394] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0239.394] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.png")) returned 1 [0239.395] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0239.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75 [0239.395] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76 [0239.395] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.396] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0239.397] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0239.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0239.397] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0239.397] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0239.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75 [0239.397] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76 [0239.397] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0239.397] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.397] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.397] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.397] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.398] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.398] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.398] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0239.398] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0239.398] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0239.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0239.398] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0239.398] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0239.398] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", dwFileAttributes=0x80) returned 1 [0239.399] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x86 [0239.399] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0239.399] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0239.400] GetFileType (hFile=0x15c) returned 0x1 [0239.400] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0239.400] GetFileType (hFile=0x15c) returned 0x1 [0239.936] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0239.936] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0239.936] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0239.937] GetFileType (hFile=0x23c) returned 0x1 [0239.937] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0239.937] GetFileType (hFile=0x23c) returned 0x1 [0239.937] ReadFile (in: hFile=0x23c, lpBuffer=0x23717b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23717b0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0239.942] ReadFile (in: hFile=0x23c, lpBuffer=0x23717b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23717b0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0239.942] ReadFile (in: hFile=0x23c, lpBuffer=0x23717b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23717b0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0239.942] ReadFile (in: hFile=0x23c, lpBuffer=0x23717b0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23717b0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0239.942] CloseHandle (hObject=0x23c) returned 1 [0239.943] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0239.943] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.png")) returned 1 [0239.946] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7e [0239.946] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0239.946] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.947] GetFileType (hFile=0x15c) returned 0x1 [0239.947] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0239.947] GetFileType (hFile=0x15c) returned 0x1 [0239.948] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0239.948] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0239.948] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0239.948] GetFileType (hFile=0x15c) returned 0x1 [0239.948] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0239.948] GetFileType (hFile=0x15c) returned 0x1 [0239.948] WriteFile (in: hFile=0x15c, lpBuffer=0x237f310*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x237f310*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0239.949] CloseHandle (hObject=0x15c) returned 1 [0239.949] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7e [0239.949] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0239.949] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.950] GetFileType (hFile=0x15c) returned 0x1 [0239.950] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0239.950] GetFileType (hFile=0x15c) returned 0x1 [0239.951] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xaa [0239.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0239.951] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.951] GetFileType (hFile=0x15c) returned 0x1 [0239.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0239.951] GetFileType (hFile=0x15c) returned 0x1 [0239.952] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0239.952] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0239.952] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.952] GetFileType (hFile=0x15c) returned 0x1 [0239.952] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0239.952] GetFileType (hFile=0x15c) returned 0x1 [0239.953] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0239.953] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0239.953] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0239.953] GetFileType (hFile=0x15c) returned 0x1 [0239.953] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0239.953] GetFileType (hFile=0x15c) returned 0x1 [0239.953] WriteFile (in: hFile=0x15c, lpBuffer=0x2390fa0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2390fa0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0239.954] CloseHandle (hObject=0x15c) returned 1 [0239.954] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0239.954] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0239.955] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.955] GetFileType (hFile=0x15c) returned 0x1 [0239.955] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0239.955] GetFileType (hFile=0x15c) returned 0x1 [0239.956] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0239.956] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0239.956] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.956] GetFileType (hFile=0x15c) returned 0x1 [0239.956] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0239.956] GetFileType (hFile=0x15c) returned 0x1 [0239.958] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0239.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0239.958] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.958] GetFileType (hFile=0x15c) returned 0x1 [0239.958] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0239.958] GetFileType (hFile=0x15c) returned 0x1 [0239.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0239.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0239.959] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0239.960] GetFileType (hFile=0x15c) returned 0x1 [0239.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0239.960] GetFileType (hFile=0x15c) returned 0x1 [0239.960] WriteFile (in: hFile=0x15c, lpBuffer=0x23a2af8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x23a2af8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0239.961] CloseHandle (hObject=0x15c) returned 1 [0239.961] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0239.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0239.961] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.961] GetFileType (hFile=0x15c) returned 0x1 [0239.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0239.961] GetFileType (hFile=0x15c) returned 0x1 [0239.962] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0239.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0239.962] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0239.962] GetFileType (hFile=0x15c) returned 0x1 [0239.962] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0239.963] GetFileType (hFile=0x15c) returned 0x1 [0239.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0239.963] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x47 [0239.963] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x48 [0239.963] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.964] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.965] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0239.965] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0239.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0239.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0239.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0239.965] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}", lpFilePart=0x0) returned 0x47 [0239.965] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\", lpFilePart=0x0) returned 0x48 [0239.965] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0239.965] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.965] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.965] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.965] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.966] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.966] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.966] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0239.966] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0239.966] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0239.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0239.966] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0239.966] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", lpFilePart=0x0) returned 0x50 [0239.966] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", dwFileAttributes=0x80) returned 1 [0239.967] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x58 [0239.967] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0239.967] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0239.968] GetFileType (hFile=0x15c) returned 0x1 [0239.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0239.968] GetFileType (hFile=0x15c) returned 0x1 [0240.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", lpFilePart=0x0) returned 0x50 [0240.568] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0240.568] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0240.569] GetFileType (hFile=0x23c) returned 0x1 [0240.569] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0240.569] GetFileType (hFile=0x23c) returned 0x1 [0240.569] ReadFile (in: hFile=0x23c, lpBuffer=0x2293458, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293458*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0240.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2293458, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293458*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0240.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2293458, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293458*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0240.574] ReadFile (in: hFile=0x23c, lpBuffer=0x2293458, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2293458*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0240.574] CloseHandle (hObject=0x23c) returned 1 [0240.575] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", lpFilePart=0x0) returned 0x50 [0240.575] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.png")) returned 1 [0240.576] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0240.576] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0240.577] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0240.577] GetFileType (hFile=0x15c) returned 0x1 [0240.577] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0240.577] GetFileType (hFile=0x15c) returned 0x1 [0240.578] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png", lpFilePart=0x0) returned 0x50 [0240.578] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0240.578] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0240.578] GetFileType (hFile=0x15c) returned 0x1 [0240.578] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0240.578] GetFileType (hFile=0x15c) returned 0x1 [0240.578] WriteFile (in: hFile=0x15c, lpBuffer=0x22a0e80*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x22a0e80*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0240.579] CloseHandle (hObject=0x15c) returned 1 [0240.580] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0240.580] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0240.580] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0240.580] GetFileType (hFile=0x15c) returned 0x1 [0240.580] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0240.580] GetFileType (hFile=0x15c) returned 0x1 [0240.581] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0240.581] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0240.581] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{3c3aafc8-d898-43ec-998f-965ffdae065a}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0240.582] GetFileType (hFile=0x15c) returned 0x1 [0240.582] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0240.582] GetFileType (hFile=0x15c) returned 0x1 [0240.583] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0240.583] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53 [0240.583] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0240.583] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0240.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.583] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.584] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0240.584] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0240.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0240.584] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0240.584] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0240.584] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017", lpFilePart=0x0) returned 0x53 [0240.584] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0240.584] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0240.585] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0240.585] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0240.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0240.585] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0240.586] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0240.586] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", dwFileAttributes=0x80) returned 1 [0240.586] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x64 [0240.586] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0240.587] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0240.587] GetFileType (hFile=0x15c) returned 0x1 [0240.587] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0240.587] GetFileType (hFile=0x15c) returned 0x1 [0241.063] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0241.063] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0241.063] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0241.064] GetFileType (hFile=0x23c) returned 0x1 [0241.064] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0241.064] GetFileType (hFile=0x23c) returned 0x1 [0241.064] ReadFile (in: hFile=0x23c, lpBuffer=0x2391af8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2391af8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0241.069] ReadFile (in: hFile=0x23c, lpBuffer=0x2391af8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2391af8*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0241.069] ReadFile (in: hFile=0x23c, lpBuffer=0x2391af8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2391af8*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0241.069] ReadFile (in: hFile=0x23c, lpBuffer=0x2391af8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2391af8*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0241.069] CloseHandle (hObject=0x23c) returned 1 [0241.070] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0241.070] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.png")) returned 1 [0241.071] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0241.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0241.071] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0241.071] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0241.071] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.071] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.072] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.072] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.072] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0241.072] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0241.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0241.072] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0241.072] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0241.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0241.072] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0241.072] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0241.072] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.072] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0241.073] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0241.073] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0241.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0241.073] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0241.073] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0241.073] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0241.074] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6d [0241.074] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0241.074] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0241.077] GetFileType (hFile=0x15c) returned 0x1 [0241.077] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0241.077] GetFileType (hFile=0x15c) returned 0x1 [0241.550] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0241.550] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0241.550] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0241.550] GetFileType (hFile=0x23c) returned 0x1 [0241.551] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0241.551] GetFileType (hFile=0x23c) returned 0x1 [0241.551] ReadFile (in: hFile=0x23c, lpBuffer=0x227ece8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227ece8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0241.556] ReadFile (in: hFile=0x23c, lpBuffer=0x227ece8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227ece8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0241.556] ReadFile (in: hFile=0x23c, lpBuffer=0x227ece8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227ece8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0241.556] ReadFile (in: hFile=0x23c, lpBuffer=0x227ece8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x227ece8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0241.556] CloseHandle (hObject=0x23c) returned 1 [0241.556] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0241.556] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.png")) returned 1 [0241.558] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0241.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71 [0241.558] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x72 [0241.558] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0241.558] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.558] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.558] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.558] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.558] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.558] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.559] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.559] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0241.559] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0241.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0241.559] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0241.559] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0241.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x71 [0241.559] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x72 [0241.559] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0241.559] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.559] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.559] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.560] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.560] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.560] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.560] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0241.560] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0241.560] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0241.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0241.560] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0241.560] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x7a [0241.560] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", dwFileAttributes=0x80) returned 1 [0241.561] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x82 [0241.561] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0241.561] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0241.562] GetFileType (hFile=0x15c) returned 0x1 [0241.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0241.562] GetFileType (hFile=0x15c) returned 0x1 [0242.062] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x7a [0242.062] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0242.062] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0242.063] GetFileType (hFile=0x23c) returned 0x1 [0242.063] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0242.063] GetFileType (hFile=0x23c) returned 0x1 [0242.063] ReadFile (in: hFile=0x23c, lpBuffer=0x236ce98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ce98*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0242.086] ReadFile (in: hFile=0x23c, lpBuffer=0x236ce98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ce98*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0242.087] ReadFile (in: hFile=0x23c, lpBuffer=0x236ce98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ce98*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0242.087] ReadFile (in: hFile=0x23c, lpBuffer=0x236ce98, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x236ce98*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0242.087] CloseHandle (hObject=0x23c) returned 1 [0242.087] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x7a [0242.087] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.png")) returned 1 [0242.090] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", lpFilePart=0x0) returned 0x7a [0242.091] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0242.091] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.091] GetFileType (hFile=0x15c) returned 0x1 [0242.091] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0242.091] GetFileType (hFile=0x15c) returned 0x1 [0242.092] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x7a [0242.092] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0242.092] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0242.092] GetFileType (hFile=0x15c) returned 0x1 [0242.092] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0242.092] GetFileType (hFile=0x15c) returned 0x1 [0242.092] WriteFile (in: hFile=0x15c, lpBuffer=0x237a9d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x237a9d8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0242.093] CloseHandle (hObject=0x15c) returned 1 [0242.094] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", lpFilePart=0x0) returned 0x7a [0242.094] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0242.094] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.094] GetFileType (hFile=0x15c) returned 0x1 [0242.094] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0242.094] GetFileType (hFile=0x15c) returned 0x1 [0242.095] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa6 [0242.095] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0242.095] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\vcruntimeminimum_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.095] GetFileType (hFile=0x15c) returned 0x1 [0242.095] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0242.095] GetFileType (hFile=0x15c) returned 0x1 [0242.096] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0242.096] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0242.096] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.096] GetFileType (hFile=0x15c) returned 0x1 [0242.096] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0242.096] GetFileType (hFile=0x15c) returned 0x1 [0242.097] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0242.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0242.097] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0242.098] GetFileType (hFile=0x15c) returned 0x1 [0242.098] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0242.098] GetFileType (hFile=0x15c) returned 0x1 [0242.098] WriteFile (in: hFile=0x15c, lpBuffer=0x238c640*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x238c640*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0242.099] CloseHandle (hObject=0x15c) returned 1 [0242.099] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0242.099] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0242.099] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.099] GetFileType (hFile=0x15c) returned 0x1 [0242.099] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0242.099] GetFileType (hFile=0x15c) returned 0x1 [0242.100] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0242.100] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0242.100] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.100] GetFileType (hFile=0x15c) returned 0x1 [0242.100] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0242.100] GetFileType (hFile=0x15c) returned 0x1 [0242.101] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0242.101] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0242.101] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.102] GetFileType (hFile=0x15c) returned 0x1 [0242.102] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0242.102] GetFileType (hFile=0x15c) returned 0x1 [0242.102] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0242.102] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0242.103] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0242.103] GetFileType (hFile=0x15c) returned 0x1 [0242.103] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0242.103] GetFileType (hFile=0x15c) returned 0x1 [0242.103] WriteFile (in: hFile=0x15c, lpBuffer=0x239e1b0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x239e1b0*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0242.104] CloseHandle (hObject=0x15c) returned 1 [0242.104] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0242.104] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0242.104] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.104] GetFileType (hFile=0x15c) returned 0x1 [0242.104] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0242.104] GetFileType (hFile=0x15c) returned 0x1 [0242.105] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0242.105] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0242.105] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{582EA838-9199-3518-A05C-DB09462F68EC}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{582ea838-9199-3518-a05c-db09462f68ec}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0242.106] GetFileType (hFile=0x15c) returned 0x1 [0242.106] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0242.106] GetFileType (hFile=0x15c) returned 0x1 [0242.106] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0242.106] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53 [0242.106] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0242.107] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.107] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0242.108] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0242.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0242.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0242.108] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0242.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017", lpFilePart=0x0) returned 0x53 [0242.108] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0242.108] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0242.108] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.108] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.108] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.108] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.108] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.109] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0242.109] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0242.109] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0242.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0242.109] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0242.109] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0242.109] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", dwFileAttributes=0x80) returned 1 [0242.110] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x64 [0242.110] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0242.110] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0242.110] GetFileType (hFile=0x15c) returned 0x1 [0242.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0242.110] GetFileType (hFile=0x15c) returned 0x1 [0242.599] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0242.599] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0242.599] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0242.600] GetFileType (hFile=0x23c) returned 0x1 [0242.600] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0242.600] GetFileType (hFile=0x23c) returned 0x1 [0242.600] ReadFile (in: hFile=0x23c, lpBuffer=0x228ea68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x228ea68*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0242.605] ReadFile (in: hFile=0x23c, lpBuffer=0x228ea68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x228ea68*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0242.605] ReadFile (in: hFile=0x23c, lpBuffer=0x228ea68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x228ea68*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0242.605] ReadFile (in: hFile=0x23c, lpBuffer=0x228ea68, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x228ea68*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0242.605] CloseHandle (hObject=0x23c) returned 1 [0242.606] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0242.606] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.png")) returned 1 [0242.607] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0242.607] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0242.607] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0242.607] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0242.607] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.608] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.608] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.608] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.608] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.608] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.608] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0242.608] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0242.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0242.608] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0242.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0242.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0242.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0242.608] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0242.609] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0242.609] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0242.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0242.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0242.610] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0242.610] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0242.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6d [0242.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0242.611] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0242.611] GetFileType (hFile=0x15c) returned 0x1 [0242.611] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0242.611] GetFileType (hFile=0x15c) returned 0x1 [0243.111] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0243.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0243.111] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0243.111] GetFileType (hFile=0x23c) returned 0x1 [0243.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0243.112] GetFileType (hFile=0x23c) returned 0x1 [0243.112] ReadFile (in: hFile=0x23c, lpBuffer=0x235c480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x235c480*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0243.117] ReadFile (in: hFile=0x23c, lpBuffer=0x235c480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x235c480*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0243.117] ReadFile (in: hFile=0x23c, lpBuffer=0x235c480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x235c480*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0243.117] ReadFile (in: hFile=0x23c, lpBuffer=0x235c480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x235c480*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0243.117] CloseHandle (hObject=0x23c) returned 1 [0243.117] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0243.118] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.png")) returned 1 [0243.119] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0243.119] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74 [0243.119] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x75 [0243.119] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0243.119] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.119] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.120] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.120] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.120] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.120] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.120] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.120] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0243.120] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0243.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0243.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0243.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0243.120] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x74 [0243.120] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x75 [0243.120] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0243.121] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0243.122] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0243.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0243.122] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0243.122] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7d [0243.122] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", dwFileAttributes=0x80) returned 1 [0243.123] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x85 [0243.123] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0243.123] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0243.123] GetFileType (hFile=0x15c) returned 0x1 [0243.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0243.123] GetFileType (hFile=0x15c) returned 0x1 [0243.680] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7d [0243.680] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0243.680] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0243.680] GetFileType (hFile=0x23c) returned 0x1 [0243.680] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0243.680] GetFileType (hFile=0x23c) returned 0x1 [0243.680] ReadFile (in: hFile=0x23c, lpBuffer=0x224d258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x224d258*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0243.685] ReadFile (in: hFile=0x23c, lpBuffer=0x224d258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x224d258*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0243.686] ReadFile (in: hFile=0x23c, lpBuffer=0x224d258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x224d258*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0243.686] ReadFile (in: hFile=0x23c, lpBuffer=0x224d258, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x224d258*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0243.686] CloseHandle (hObject=0x23c) returned 1 [0243.686] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7d [0243.687] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.png")) returned 1 [0243.688] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.TXT", lpFilePart=0x0) returned 0x7d [0243.688] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0243.688] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.689] GetFileType (hFile=0x15c) returned 0x1 [0243.689] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0243.689] GetFileType (hFile=0x15c) returned 0x1 [0243.689] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7d [0243.690] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0243.690] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0243.691] GetFileType (hFile=0x15c) returned 0x1 [0243.691] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0243.691] GetFileType (hFile=0x15c) returned 0x1 [0243.691] WriteFile (in: hFile=0x15c, lpBuffer=0x225adb8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x225adb8*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0243.692] CloseHandle (hObject=0x15c) returned 1 [0243.692] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.vbs", lpFilePart=0x0) returned 0x7d [0243.693] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0243.693] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.693] GetFileType (hFile=0x15c) returned 0x1 [0243.693] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0243.693] GetFileType (hFile=0x15c) returned 0x1 [0243.694] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa9 [0243.694] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0243.694] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.694] GetFileType (hFile=0x15c) returned 0x1 [0243.694] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0243.694] GetFileType (hFile=0x15c) returned 0x1 [0243.695] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0243.695] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0243.695] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.695] GetFileType (hFile=0x15c) returned 0x1 [0243.695] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0243.695] GetFileType (hFile=0x15c) returned 0x1 [0243.696] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0243.696] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0243.696] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0243.696] GetFileType (hFile=0x15c) returned 0x1 [0243.696] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0243.696] GetFileType (hFile=0x15c) returned 0x1 [0243.696] WriteFile (in: hFile=0x15c, lpBuffer=0x226ca48*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x226ca48*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0243.697] CloseHandle (hObject=0x15c) returned 1 [0243.697] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0243.697] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0243.697] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.698] GetFileType (hFile=0x15c) returned 0x1 [0243.698] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0243.698] GetFileType (hFile=0x15c) returned 0x1 [0243.699] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0243.699] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0243.699] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.699] GetFileType (hFile=0x15c) returned 0x1 [0243.699] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0243.699] GetFileType (hFile=0x15c) returned 0x1 [0243.700] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0243.700] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0243.700] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.700] GetFileType (hFile=0x15c) returned 0x1 [0243.700] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0243.700] GetFileType (hFile=0x15c) returned 0x1 [0243.701] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0243.701] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0243.701] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0243.701] GetFileType (hFile=0x15c) returned 0x1 [0243.701] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0243.701] GetFileType (hFile=0x15c) returned 0x1 [0243.701] WriteFile (in: hFile=0x15c, lpBuffer=0x227e5b8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x227e5b8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0243.702] CloseHandle (hObject=0x15c) returned 1 [0243.703] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0243.703] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0243.703] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.703] GetFileType (hFile=0x15c) returned 0x1 [0243.703] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0243.703] GetFileType (hFile=0x15c) returned 0x1 [0243.704] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0243.704] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0243.704] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0243.704] GetFileType (hFile=0x15c) returned 0x1 [0243.704] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0243.704] GetFileType (hFile=0x15c) returned 0x1 [0243.705] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0243.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x53 [0243.705] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0243.705] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0243.705] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.705] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.706] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0243.706] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0243.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0243.706] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0243.706] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0243.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017", lpFilePart=0x0) returned 0x53 [0243.706] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0243.706] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0243.707] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0243.707] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0243.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0243.707] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0243.708] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0243.708] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", dwFileAttributes=0x80) returned 1 [0243.708] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x64 [0243.708] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0243.708] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0243.709] GetFileType (hFile=0x15c) returned 0x1 [0243.709] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0243.709] GetFileType (hFile=0x15c) returned 0x1 [0244.328] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0244.328] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0244.328] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0244.329] GetFileType (hFile=0x23c) returned 0x1 [0244.329] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0244.329] GetFileType (hFile=0x23c) returned 0x1 [0244.329] ReadFile (in: hFile=0x23c, lpBuffer=0x2371d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2371d70*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0244.335] ReadFile (in: hFile=0x23c, lpBuffer=0x2371d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2371d70*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0244.336] ReadFile (in: hFile=0x23c, lpBuffer=0x2371d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2371d70*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0244.336] ReadFile (in: hFile=0x23c, lpBuffer=0x2371d70, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2371d70*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0244.336] CloseHandle (hObject=0x23c) returned 1 [0244.336] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0244.336] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.png")) returned 1 [0244.338] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0244.338] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0244.338] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0244.338] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0244.338] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.338] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.338] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.338] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.339] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.339] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.339] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0244.339] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0244.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0244.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0244.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0244.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0244.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0244.339] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0244.339] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.340] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.340] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.340] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.340] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.340] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0244.340] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0244.340] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0244.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0244.340] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0244.340] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0244.340] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0244.341] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6d [0244.341] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0244.341] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0244.342] GetFileType (hFile=0x15c) returned 0x1 [0244.342] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0244.342] GetFileType (hFile=0x15c) returned 0x1 [0244.834] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0244.834] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0244.834] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0244.834] GetFileType (hFile=0x23c) returned 0x1 [0244.835] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0244.835] GetFileType (hFile=0x23c) returned 0x1 [0244.835] ReadFile (in: hFile=0x23c, lpBuffer=0x22619a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22619a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0244.840] ReadFile (in: hFile=0x23c, lpBuffer=0x22619a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22619a8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0244.840] ReadFile (in: hFile=0x23c, lpBuffer=0x22619a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22619a8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0244.840] ReadFile (in: hFile=0x23c, lpBuffer=0x22619a8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x22619a8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0244.840] CloseHandle (hObject=0x23c) returned 1 [0244.840] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0244.840] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.png")) returned 1 [0244.842] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0244.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x73 [0244.842] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x74 [0244.842] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0244.842] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.843] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0244.843] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0244.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0244.843] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0244.843] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0244.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x73 [0244.843] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x74 [0244.844] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0244.844] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.844] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.845] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0244.845] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0244.845] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0244.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0244.845] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0244.845] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7c [0244.845] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", dwFileAttributes=0x80) returned 1 [0244.846] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x84 [0244.846] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0244.846] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0244.846] GetFileType (hFile=0x15c) returned 0x1 [0244.846] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0244.846] GetFileType (hFile=0x15c) returned 0x1 [0245.339] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7c [0245.339] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0245.339] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0245.339] GetFileType (hFile=0x23c) returned 0x1 [0245.339] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0245.339] GetFileType (hFile=0x23c) returned 0x1 [0245.339] ReadFile (in: hFile=0x23c, lpBuffer=0x23526a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23526a0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0245.344] ReadFile (in: hFile=0x23c, lpBuffer=0x23526a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23526a0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0245.345] ReadFile (in: hFile=0x23c, lpBuffer=0x23526a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23526a0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0245.345] ReadFile (in: hFile=0x23c, lpBuffer=0x23526a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x23526a0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0245.345] CloseHandle (hObject=0x23c) returned 1 [0245.345] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7c [0245.345] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.png")) returned 1 [0245.348] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7c [0245.348] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0245.348] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.349] GetFileType (hFile=0x15c) returned 0x1 [0245.349] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0245.349] GetFileType (hFile=0x15c) returned 0x1 [0245.350] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7c [0245.350] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0245.350] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0245.350] GetFileType (hFile=0x15c) returned 0x1 [0245.350] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0245.350] GetFileType (hFile=0x15c) returned 0x1 [0245.350] WriteFile (in: hFile=0x15c, lpBuffer=0x2360200*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2360200*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0245.351] CloseHandle (hObject=0x15c) returned 1 [0245.351] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7c [0245.351] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0245.351] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.351] GetFileType (hFile=0x15c) returned 0x1 [0245.352] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0245.352] GetFileType (hFile=0x15c) returned 0x1 [0245.352] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa8 [0245.352] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0245.352] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\vcruntimeminimum_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.353] GetFileType (hFile=0x15c) returned 0x1 [0245.353] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0245.353] GetFileType (hFile=0x15c) returned 0x1 [0245.354] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0245.354] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0245.354] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.354] GetFileType (hFile=0x15c) returned 0x1 [0245.354] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0245.354] GetFileType (hFile=0x15c) returned 0x1 [0245.355] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0245.355] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0245.355] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0245.355] GetFileType (hFile=0x15c) returned 0x1 [0245.355] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0245.355] GetFileType (hFile=0x15c) returned 0x1 [0245.355] WriteFile (in: hFile=0x15c, lpBuffer=0x2371e90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2371e90*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0245.356] CloseHandle (hObject=0x15c) returned 1 [0245.357] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0245.357] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0245.357] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.357] GetFileType (hFile=0x15c) returned 0x1 [0245.357] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0245.357] GetFileType (hFile=0x15c) returned 0x1 [0245.358] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0245.358] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0245.358] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.358] GetFileType (hFile=0x15c) returned 0x1 [0245.358] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0245.358] GetFileType (hFile=0x15c) returned 0x1 [0245.359] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0245.359] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0245.359] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.360] GetFileType (hFile=0x15c) returned 0x1 [0245.360] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0245.360] GetFileType (hFile=0x15c) returned 0x1 [0245.361] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0245.361] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0245.361] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0245.361] GetFileType (hFile=0x15c) returned 0x1 [0245.361] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0245.361] GetFileType (hFile=0x15c) returned 0x1 [0245.361] WriteFile (in: hFile=0x15c, lpBuffer=0x2383a00*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2383a00*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0245.362] CloseHandle (hObject=0x15c) returned 1 [0245.362] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0245.362] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0245.362] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.363] GetFileType (hFile=0x15c) returned 0x1 [0245.363] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0245.363] GetFileType (hFile=0x15c) returned 0x1 [0245.364] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0245.364] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0245.364] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{8D4F7A6D-6B81-3DC8-9C21-6008E4866727}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{8d4f7a6d-6b81-3dc8-9c21-6008e4866727}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0245.364] GetFileType (hFile=0x15c) returned 0x1 [0245.364] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0245.364] GetFileType (hFile=0x15c) returned 0x1 [0245.365] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0245.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x52 [0245.365] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0245.365] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0245.365] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.365] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.365] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.365] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.366] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.366] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.366] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0245.366] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0245.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0245.366] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0245.366] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0245.366] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005", lpFilePart=0x0) returned 0x52 [0245.366] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0245.366] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0245.366] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.367] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.367] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.367] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.367] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.367] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0245.367] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0245.367] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0245.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0245.367] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0245.367] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0245.367] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", dwFileAttributes=0x80) returned 1 [0245.368] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0245.368] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0245.368] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0245.369] GetFileType (hFile=0x15c) returned 0x1 [0245.369] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0245.369] GetFileType (hFile=0x15c) returned 0x1 [0245.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0245.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0245.881] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0245.882] GetFileType (hFile=0x23c) returned 0x1 [0245.882] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0245.882] GetFileType (hFile=0x23c) returned 0x1 [0245.882] ReadFile (in: hFile=0x23c, lpBuffer=0x2277188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2277188*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0245.887] ReadFile (in: hFile=0x23c, lpBuffer=0x2277188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2277188*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0245.887] ReadFile (in: hFile=0x23c, lpBuffer=0x2277188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2277188*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0245.887] ReadFile (in: hFile=0x23c, lpBuffer=0x2277188, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2277188*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0245.887] CloseHandle (hObject=0x23c) returned 1 [0245.888] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0245.888] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.png")) returned 1 [0245.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0245.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0245.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0245.890] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.890] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0245.891] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0245.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0245.891] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0245.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0245.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0245.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0245.891] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0245.891] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.891] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.891] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.891] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0245.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0245.892] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0245.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0245.892] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0245.892] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0245.892] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0245.893] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0245.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0245.893] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0245.894] GetFileType (hFile=0x15c) returned 0x1 [0245.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0245.894] GetFileType (hFile=0x15c) returned 0x1 [0246.403] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0246.403] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0246.403] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0246.404] GetFileType (hFile=0x23c) returned 0x1 [0246.404] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0246.404] GetFileType (hFile=0x23c) returned 0x1 [0246.404] ReadFile (in: hFile=0x23c, lpBuffer=0x2366d28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2366d28*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0246.409] ReadFile (in: hFile=0x23c, lpBuffer=0x2366d28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2366d28*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0246.409] ReadFile (in: hFile=0x23c, lpBuffer=0x2366d28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2366d28*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0246.409] ReadFile (in: hFile=0x23c, lpBuffer=0x2366d28, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2366d28*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0246.409] CloseHandle (hObject=0x23c) returned 1 [0246.409] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0246.409] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.png")) returned 1 [0246.410] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0246.410] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75 [0246.411] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76 [0246.411] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.411] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.412] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0246.412] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0246.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0246.412] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0246.412] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0246.412] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x75 [0246.412] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x76 [0246.412] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0246.412] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.412] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.412] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.412] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.413] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.413] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.413] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0246.413] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0246.413] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0246.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0246.413] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0246.413] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0246.413] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", dwFileAttributes=0x80) returned 1 [0246.414] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x86 [0246.414] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0246.414] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0246.415] GetFileType (hFile=0x15c) returned 0x1 [0246.415] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0246.415] GetFileType (hFile=0x15c) returned 0x1 [0246.950] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0246.951] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0246.951] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0246.951] GetFileType (hFile=0x23c) returned 0x1 [0246.951] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0246.951] GetFileType (hFile=0x23c) returned 0x1 [0246.951] ReadFile (in: hFile=0x23c, lpBuffer=0x2257b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2257b30*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0246.954] ReadFile (in: hFile=0x23c, lpBuffer=0x2257b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2257b30*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0246.956] ReadFile (in: hFile=0x23c, lpBuffer=0x2257b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2257b30*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0246.956] ReadFile (in: hFile=0x23c, lpBuffer=0x2257b30, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2257b30*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0246.957] CloseHandle (hObject=0x23c) returned 1 [0246.957] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0246.957] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.png")) returned 1 [0246.958] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7e [0246.958] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0246.958] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.959] GetFileType (hFile=0x15c) returned 0x1 [0246.959] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0246.959] GetFileType (hFile=0x15c) returned 0x1 [0246.959] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7e [0246.959] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0246.959] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0246.960] GetFileType (hFile=0x15c) returned 0x1 [0246.960] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0246.960] GetFileType (hFile=0x15c) returned 0x1 [0246.960] WriteFile (in: hFile=0x15c, lpBuffer=0x2265690*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2265690*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0246.961] CloseHandle (hObject=0x15c) returned 1 [0246.961] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7e [0246.961] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0246.961] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.961] GetFileType (hFile=0x15c) returned 0x1 [0246.961] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0246.961] GetFileType (hFile=0x15c) returned 0x1 [0246.962] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xaa [0246.962] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0246.962] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.963] GetFileType (hFile=0x15c) returned 0x1 [0246.963] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0246.963] GetFileType (hFile=0x15c) returned 0x1 [0246.963] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0246.963] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0246.963] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.964] GetFileType (hFile=0x15c) returned 0x1 [0246.964] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0246.964] GetFileType (hFile=0x15c) returned 0x1 [0246.965] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0246.965] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0246.965] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0246.965] GetFileType (hFile=0x15c) returned 0x1 [0246.965] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0246.965] GetFileType (hFile=0x15c) returned 0x1 [0246.965] WriteFile (in: hFile=0x15c, lpBuffer=0x2277320*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2277320*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0246.966] CloseHandle (hObject=0x15c) returned 1 [0246.966] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0246.966] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0246.966] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.967] GetFileType (hFile=0x15c) returned 0x1 [0246.967] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0246.967] GetFileType (hFile=0x15c) returned 0x1 [0246.967] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0246.968] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0246.968] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.968] GetFileType (hFile=0x15c) returned 0x1 [0246.968] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0246.968] GetFileType (hFile=0x15c) returned 0x1 [0246.969] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0246.969] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0246.969] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.969] GetFileType (hFile=0x15c) returned 0x1 [0246.969] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0246.969] GetFileType (hFile=0x15c) returned 0x1 [0246.970] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0246.970] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0246.970] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0246.970] GetFileType (hFile=0x15c) returned 0x1 [0246.970] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0246.970] GetFileType (hFile=0x15c) returned 0x1 [0246.970] WriteFile (in: hFile=0x15c, lpBuffer=0x2288e78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2288e78*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0246.971] CloseHandle (hObject=0x15c) returned 1 [0246.971] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0246.971] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0246.971] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.971] GetFileType (hFile=0x15c) returned 0x1 [0246.972] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0246.972] GetFileType (hFile=0x15c) returned 0x1 [0246.972] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0246.972] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0246.972] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0246.973] GetFileType (hFile=0x15c) returned 0x1 [0246.973] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0246.973] GetFileType (hFile=0x15c) returned 0x1 [0246.974] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0246.974] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x52 [0246.974] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0246.974] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0246.974] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.974] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.974] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.974] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.974] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.974] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.975] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0246.975] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0246.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0246.975] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0246.975] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0246.975] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005", lpFilePart=0x0) returned 0x52 [0246.975] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0246.975] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0246.975] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.975] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.975] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.975] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.976] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.976] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0246.976] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0246.976] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0246.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0246.976] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0246.976] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0246.976] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", dwFileAttributes=0x80) returned 1 [0246.977] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0246.977] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0246.977] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0246.977] GetFileType (hFile=0x15c) returned 0x1 [0246.978] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0246.978] GetFileType (hFile=0x15c) returned 0x1 [0247.457] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0247.457] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0247.457] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0247.458] GetFileType (hFile=0x23c) returned 0x1 [0247.458] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0247.458] GetFileType (hFile=0x23c) returned 0x1 [0247.458] ReadFile (in: hFile=0x23c, lpBuffer=0x237c540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237c540*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0247.470] ReadFile (in: hFile=0x23c, lpBuffer=0x237c540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237c540*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0247.470] ReadFile (in: hFile=0x23c, lpBuffer=0x237c540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237c540*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0247.470] ReadFile (in: hFile=0x23c, lpBuffer=0x237c540, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x237c540*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0247.470] CloseHandle (hObject=0x23c) returned 1 [0247.470] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0247.470] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.png")) returned 1 [0247.472] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0247.472] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0247.472] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0247.472] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0247.472] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.472] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.472] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.472] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.472] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.472] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.473] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0247.473] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0247.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0247.473] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0247.473] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0247.473] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0247.473] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0247.473] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0247.473] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.473] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.473] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.473] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.474] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.474] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0247.474] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0247.474] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0247.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0247.474] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0247.474] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0247.474] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0247.475] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0247.475] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0247.475] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0247.475] GetFileType (hFile=0x15c) returned 0x1 [0247.475] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0247.476] GetFileType (hFile=0x15c) returned 0x1 [0247.992] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0247.992] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0247.992] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0247.993] GetFileType (hFile=0x23c) returned 0x1 [0247.993] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0247.993] GetFileType (hFile=0x23c) returned 0x1 [0247.993] ReadFile (in: hFile=0x23c, lpBuffer=0x226c110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226c110*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0247.998] ReadFile (in: hFile=0x23c, lpBuffer=0x226c110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226c110*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0247.998] ReadFile (in: hFile=0x23c, lpBuffer=0x226c110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226c110*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0247.998] ReadFile (in: hFile=0x23c, lpBuffer=0x226c110, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226c110*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0247.998] CloseHandle (hObject=0x23c) returned 1 [0247.999] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0247.999] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.png")) returned 1 [0248.000] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0248.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72 [0248.000] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73 [0248.001] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0248.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.001] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.002] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.002] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.002] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0248.002] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0248.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0248.002] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0248.002] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0248.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72 [0248.002] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73 [0248.002] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0248.003] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0248.004] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0248.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0248.004] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0248.004] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0248.004] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", dwFileAttributes=0x80) returned 1 [0248.005] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x83 [0248.005] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0248.005] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0248.005] GetFileType (hFile=0x15c) returned 0x1 [0248.005] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0248.005] GetFileType (hFile=0x15c) returned 0x1 [0248.598] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0248.598] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0248.598] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0248.598] GetFileType (hFile=0x23c) returned 0x1 [0248.598] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0248.598] GetFileType (hFile=0x23c) returned 0x1 [0248.598] ReadFile (in: hFile=0x23c, lpBuffer=0x235cd00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235cd00*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0248.604] ReadFile (in: hFile=0x23c, lpBuffer=0x235cd00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235cd00*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0248.604] ReadFile (in: hFile=0x23c, lpBuffer=0x235cd00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235cd00*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0248.604] ReadFile (in: hFile=0x23c, lpBuffer=0x235cd00, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235cd00*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0248.604] CloseHandle (hObject=0x23c) returned 1 [0248.604] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0248.604] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.png")) returned 1 [0248.608] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7b [0248.608] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0248.608] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.609] GetFileType (hFile=0x15c) returned 0x1 [0248.609] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0248.609] GetFileType (hFile=0x15c) returned 0x1 [0248.610] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0248.610] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0248.610] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0248.610] GetFileType (hFile=0x15c) returned 0x1 [0248.610] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0248.610] GetFileType (hFile=0x15c) returned 0x1 [0248.610] WriteFile (in: hFile=0x15c, lpBuffer=0x236a840*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x236a840*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0248.611] CloseHandle (hObject=0x15c) returned 1 [0248.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7b [0248.611] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0248.611] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.612] GetFileType (hFile=0x15c) returned 0x1 [0248.612] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0248.612] GetFileType (hFile=0x15c) returned 0x1 [0248.613] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa7 [0248.613] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0248.613] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\vcruntimeminimum_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.613] GetFileType (hFile=0x15c) returned 0x1 [0248.613] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0248.613] GetFileType (hFile=0x15c) returned 0x1 [0248.614] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0248.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0248.614] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.614] GetFileType (hFile=0x15c) returned 0x1 [0248.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0248.614] GetFileType (hFile=0x15c) returned 0x1 [0248.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0248.615] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0248.615] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0248.615] GetFileType (hFile=0x15c) returned 0x1 [0248.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0248.615] GetFileType (hFile=0x15c) returned 0x1 [0248.615] WriteFile (in: hFile=0x15c, lpBuffer=0x237c4a8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x237c4a8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0248.616] CloseHandle (hObject=0x15c) returned 1 [0248.616] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0248.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0248.616] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.617] GetFileType (hFile=0x15c) returned 0x1 [0248.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0248.617] GetFileType (hFile=0x15c) returned 0x1 [0248.617] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0248.618] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0248.618] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.618] GetFileType (hFile=0x15c) returned 0x1 [0248.618] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0248.618] GetFileType (hFile=0x15c) returned 0x1 [0248.619] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0248.619] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0248.619] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.619] GetFileType (hFile=0x15c) returned 0x1 [0248.619] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0248.619] GetFileType (hFile=0x15c) returned 0x1 [0248.620] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0248.620] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0248.620] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0248.620] GetFileType (hFile=0x15c) returned 0x1 [0248.620] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0248.620] GetFileType (hFile=0x15c) returned 0x1 [0248.620] WriteFile (in: hFile=0x15c, lpBuffer=0x238e000*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x238e000*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0248.621] CloseHandle (hObject=0x15c) returned 1 [0248.621] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0248.621] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0248.621] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.622] GetFileType (hFile=0x15c) returned 0x1 [0248.622] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0248.622] GetFileType (hFile=0x15c) returned 0x1 [0248.622] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0248.622] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0248.622] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{A749D8E6-B613-3BE3-8F5F-045C84EBA29B}v12.0.21005\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{a749d8e6-b613-3be3-8f5f-045c84eba29b}v12.0.21005\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0248.623] GetFileType (hFile=0x15c) returned 0x1 [0248.623] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0248.623] GetFileType (hFile=0x15c) returned 0x1 [0248.624] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0248.624] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52 [0248.624] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0248.624] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0248.624] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.624] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.624] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.624] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.624] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.625] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.625] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0248.625] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0248.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0248.625] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0248.625] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0248.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030", lpFilePart=0x0) returned 0x52 [0248.625] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0248.625] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0248.625] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.625] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.626] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.626] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.626] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.626] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0248.626] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0248.626] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0248.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0248.626] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0248.626] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0248.626] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", dwFileAttributes=0x80) returned 1 [0248.627] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0248.627] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0248.627] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0248.628] GetFileType (hFile=0x15c) returned 0x1 [0248.628] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0248.628] GetFileType (hFile=0x15c) returned 0x1 [0249.150] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0249.150] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0249.151] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0249.151] GetFileType (hFile=0x23c) returned 0x1 [0249.151] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0249.151] GetFileType (hFile=0x23c) returned 0x1 [0249.151] ReadFile (in: hFile=0x23c, lpBuffer=0x2281750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2281750*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0249.158] ReadFile (in: hFile=0x23c, lpBuffer=0x2281750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2281750*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0249.158] ReadFile (in: hFile=0x23c, lpBuffer=0x2281750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2281750*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0249.158] ReadFile (in: hFile=0x23c, lpBuffer=0x2281750, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2281750*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0249.158] CloseHandle (hObject=0x23c) returned 1 [0249.159] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0249.159] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.png")) returned 1 [0249.160] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0249.160] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0249.161] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0249.161] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0249.161] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.161] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.161] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.161] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.161] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.162] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.162] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0249.162] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0249.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0249.162] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0249.162] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0249.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0249.162] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0249.163] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0249.163] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.163] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.163] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.163] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.164] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.164] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0249.164] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0249.164] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0249.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0249.164] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0249.164] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0249.164] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0249.165] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0249.165] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0249.165] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0249.166] GetFileType (hFile=0x15c) returned 0x1 [0249.166] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0249.166] GetFileType (hFile=0x15c) returned 0x1 [0249.658] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0249.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0249.658] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0249.659] GetFileType (hFile=0x23c) returned 0x1 [0249.659] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0249.659] GetFileType (hFile=0x23c) returned 0x1 [0249.659] ReadFile (in: hFile=0x23c, lpBuffer=0x2370bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2370bb8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0249.664] ReadFile (in: hFile=0x23c, lpBuffer=0x2370bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2370bb8*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0249.664] ReadFile (in: hFile=0x23c, lpBuffer=0x2370bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2370bb8*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0249.664] ReadFile (in: hFile=0x23c, lpBuffer=0x2370bb8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2370bb8*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0249.664] CloseHandle (hObject=0x23c) returned 1 [0249.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0249.665] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.png")) returned 1 [0249.666] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0249.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0249.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74 [0249.666] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0249.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0249.667] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0249.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0249.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0249.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0249.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86", lpFilePart=0x0) returned 0x73 [0249.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\", lpFilePart=0x0) returned 0x74 [0249.667] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0249.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0249.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0249.668] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0249.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0249.669] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0249.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7c [0249.669] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", dwFileAttributes=0x80) returned 1 [0249.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x84 [0249.670] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0249.670] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0249.670] GetFileType (hFile=0x15c) returned 0x1 [0249.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0249.670] GetFileType (hFile=0x15c) returned 0x1 [0250.171] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7c [0250.171] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0250.171] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0250.172] GetFileType (hFile=0x23c) returned 0x1 [0250.172] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0250.172] GetFileType (hFile=0x23c) returned 0x1 [0250.172] ReadFile (in: hFile=0x23c, lpBuffer=0x2260fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2260fe8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0250.176] ReadFile (in: hFile=0x23c, lpBuffer=0x2260fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2260fe8*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0250.177] ReadFile (in: hFile=0x23c, lpBuffer=0x2260fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2260fe8*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0250.178] ReadFile (in: hFile=0x23c, lpBuffer=0x2260fe8, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x2260fe8*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0250.178] CloseHandle (hObject=0x23c) returned 1 [0250.178] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7c [0250.178] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.png")) returned 1 [0250.179] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.TXT", lpFilePart=0x0) returned 0x7c [0250.180] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0250.180] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.180] GetFileType (hFile=0x15c) returned 0x1 [0250.180] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0250.180] GetFileType (hFile=0x15c) returned 0x1 [0250.181] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png", lpFilePart=0x0) returned 0x7c [0250.181] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0250.181] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0250.181] GetFileType (hFile=0x15c) returned 0x1 [0250.181] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0250.181] GetFileType (hFile=0x15c) returned 0x1 [0250.181] WriteFile (in: hFile=0x15c, lpBuffer=0x226eb48*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x226eb48*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0250.182] CloseHandle (hObject=0x15c) returned 1 [0250.182] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.vbs", lpFilePart=0x0) returned 0x7c [0250.182] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0250.182] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.183] GetFileType (hFile=0x15c) returned 0x1 [0250.183] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0250.183] GetFileType (hFile=0x15c) returned 0x1 [0250.183] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa8 [0250.183] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0250.184] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.184] GetFileType (hFile=0x15c) returned 0x1 [0250.184] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0250.184] GetFileType (hFile=0x15c) returned 0x1 [0250.185] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0250.185] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0250.185] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.185] GetFileType (hFile=0x15c) returned 0x1 [0250.185] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0250.185] GetFileType (hFile=0x15c) returned 0x1 [0250.186] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0250.186] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0250.186] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0250.187] GetFileType (hFile=0x15c) returned 0x1 [0250.187] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0250.187] GetFileType (hFile=0x15c) returned 0x1 [0250.187] WriteFile (in: hFile=0x15c, lpBuffer=0x22807d8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x22807d8*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0250.188] CloseHandle (hObject=0x15c) returned 1 [0250.188] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0250.188] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0250.188] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.188] GetFileType (hFile=0x15c) returned 0x1 [0250.188] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0250.188] GetFileType (hFile=0x15c) returned 0x1 [0250.189] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0250.189] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0250.189] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.190] GetFileType (hFile=0x15c) returned 0x1 [0250.190] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0250.190] GetFileType (hFile=0x15c) returned 0x1 [0250.191] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0250.191] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0250.191] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.191] GetFileType (hFile=0x15c) returned 0x1 [0250.191] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0250.191] GetFileType (hFile=0x15c) returned 0x1 [0250.192] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0250.192] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0250.192] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0250.193] GetFileType (hFile=0x15c) returned 0x1 [0250.193] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0250.193] GetFileType (hFile=0x15c) returned 0x1 [0250.193] WriteFile (in: hFile=0x15c, lpBuffer=0x2292330*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2292330*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0250.194] CloseHandle (hObject=0x15c) returned 1 [0250.194] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0250.194] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0250.194] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.194] GetFileType (hFile=0x15c) returned 0x1 [0250.194] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0250.194] GetFileType (hFile=0x15c) returned 0x1 [0250.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0250.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0250.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0250.196] GetFileType (hFile=0x15c) returned 0x1 [0250.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0250.196] GetFileType (hFile=0x15c) returned 0x1 [0250.196] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0250.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52 [0250.197] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0250.197] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0250.197] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.197] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0250.198] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0250.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0250.198] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0250.198] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0250.198] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030", lpFilePart=0x0) returned 0x52 [0250.198] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0250.198] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0250.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.198] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0250.199] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0250.199] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0250.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0250.199] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0250.199] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0250.199] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", dwFileAttributes=0x80) returned 1 [0250.200] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0250.200] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0250.200] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0250.201] GetFileType (hFile=0x15c) returned 0x1 [0250.201] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0250.201] GetFileType (hFile=0x15c) returned 0x1 [0250.769] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0250.770] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0250.770] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0250.770] GetFileType (hFile=0x23c) returned 0x1 [0250.770] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0250.770] GetFileType (hFile=0x23c) returned 0x1 [0250.770] ReadFile (in: hFile=0x23c, lpBuffer=0x2382c90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2382c90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0250.777] ReadFile (in: hFile=0x23c, lpBuffer=0x2382c90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2382c90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0250.777] ReadFile (in: hFile=0x23c, lpBuffer=0x2382c90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2382c90*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0250.777] ReadFile (in: hFile=0x23c, lpBuffer=0x2382c90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2382c90*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0250.777] CloseHandle (hObject=0x23c) returned 1 [0250.778] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0250.778] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.png")) returned 1 [0250.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0250.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0250.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0250.779] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0250.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.780] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0250.781] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0250.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0250.781] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0250.781] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0250.781] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0250.781] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0250.781] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0250.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.781] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0250.782] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0250.782] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0250.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0250.782] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0250.783] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0250.783] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0250.784] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0250.784] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0250.784] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0250.784] GetFileType (hFile=0x15c) returned 0x1 [0250.784] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0250.784] GetFileType (hFile=0x15c) returned 0x1 [0251.276] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0251.276] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0251.276] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0251.276] GetFileType (hFile=0x23c) returned 0x1 [0251.276] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0251.276] GetFileType (hFile=0x23c) returned 0x1 [0251.276] ReadFile (in: hFile=0x23c, lpBuffer=0x226fe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226fe40*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0251.281] ReadFile (in: hFile=0x23c, lpBuffer=0x226fe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226fe40*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0251.281] ReadFile (in: hFile=0x23c, lpBuffer=0x226fe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226fe40*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0251.282] ReadFile (in: hFile=0x23c, lpBuffer=0x226fe40, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x226fe40*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0251.282] CloseHandle (hObject=0x23c) returned 1 [0251.282] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0251.282] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.png")) returned 1 [0251.283] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0251.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0251.283] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0251.283] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0251.283] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.284] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0251.284] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0251.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0251.285] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0251.285] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0251.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86", lpFilePart=0x0) returned 0x70 [0251.285] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\", lpFilePart=0x0) returned 0x71 [0251.285] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0251.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.285] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0251.286] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0251.286] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0251.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0251.287] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0251.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0251.287] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", dwFileAttributes=0x80) returned 1 [0251.287] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x81 [0251.288] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0251.288] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0251.288] GetFileType (hFile=0x15c) returned 0x1 [0251.288] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0251.288] GetFileType (hFile=0x15c) returned 0x1 [0251.862] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0251.862] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0251.862] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0251.863] GetFileType (hFile=0x23c) returned 0x1 [0251.863] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0251.863] GetFileType (hFile=0x23c) returned 0x1 [0251.863] ReadFile (in: hFile=0x23c, lpBuffer=0x235df80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235df80*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0251.868] ReadFile (in: hFile=0x23c, lpBuffer=0x235df80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235df80*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0251.868] ReadFile (in: hFile=0x23c, lpBuffer=0x235df80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235df80*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0251.868] ReadFile (in: hFile=0x23c, lpBuffer=0x235df80, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x235df80*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0251.868] CloseHandle (hObject=0x23c) returned 1 [0251.869] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0251.869] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.png")) returned 1 [0251.872] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.TXT", lpFilePart=0x0) returned 0x79 [0251.872] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0251.872] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.873] GetFileType (hFile=0x15c) returned 0x1 [0251.873] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0251.873] GetFileType (hFile=0x15c) returned 0x1 [0251.874] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png", lpFilePart=0x0) returned 0x79 [0251.874] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0251.874] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0251.875] GetFileType (hFile=0x15c) returned 0x1 [0251.875] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0251.875] GetFileType (hFile=0x15c) returned 0x1 [0251.875] WriteFile (in: hFile=0x15c, lpBuffer=0x236bac0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x236bac0*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0251.876] CloseHandle (hObject=0x15c) returned 1 [0251.877] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.vbs", lpFilePart=0x0) returned 0x79 [0251.877] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0251.877] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.877] GetFileType (hFile=0x15c) returned 0x1 [0251.877] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0251.877] GetFileType (hFile=0x15c) returned 0x1 [0251.878] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa5 [0251.878] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0251.878] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\vcRuntimeMinimum_x86\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\vcruntimeminimum_x86\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.879] GetFileType (hFile=0x15c) returned 0x1 [0251.879] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0251.879] GetFileType (hFile=0x15c) returned 0x1 [0251.879] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0251.880] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0251.880] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.880] GetFileType (hFile=0x15c) returned 0x1 [0251.880] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0251.880] GetFileType (hFile=0x15c) returned 0x1 [0251.881] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0251.881] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0251.881] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0251.881] GetFileType (hFile=0x15c) returned 0x1 [0251.881] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0251.881] GetFileType (hFile=0x15c) returned 0x1 [0251.881] WriteFile (in: hFile=0x15c, lpBuffer=0x237d728*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x237d728*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0251.882] CloseHandle (hObject=0x15c) returned 1 [0251.882] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0251.882] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0251.882] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.883] GetFileType (hFile=0x15c) returned 0x1 [0251.883] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0251.883] GetFileType (hFile=0x15c) returned 0x1 [0251.885] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0251.885] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0251.885] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.885] GetFileType (hFile=0x15c) returned 0x1 [0251.885] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0251.885] GetFileType (hFile=0x15c) returned 0x1 [0251.886] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0251.886] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0251.886] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.886] GetFileType (hFile=0x15c) returned 0x1 [0251.886] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0251.886] GetFileType (hFile=0x15c) returned 0x1 [0251.887] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0251.887] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0251.887] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0251.887] GetFileType (hFile=0x15c) returned 0x1 [0251.887] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0251.887] GetFileType (hFile=0x15c) returned 0x1 [0251.888] WriteFile (in: hFile=0x15c, lpBuffer=0x238f280*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x238f280*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0251.889] CloseHandle (hObject=0x15c) returned 1 [0251.889] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0251.889] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0251.889] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.889] GetFileType (hFile=0x15c) returned 0x1 [0251.889] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0251.889] GetFileType (hFile=0x15c) returned 0x1 [0251.890] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0251.890] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0251.890] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{bd95a8cd-1d9f-35ad-981a-3e7925026ebb}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0251.890] GetFileType (hFile=0x15c) returned 0x1 [0251.890] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0251.890] GetFileType (hFile=0x15c) returned 0x1 [0251.891] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0251.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x47 [0251.891] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpFilePart=0x0) returned 0x48 [0251.891] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.892] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0251.893] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0251.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0251.893] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0251.893] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0251.893] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}", lpFilePart=0x0) returned 0x47 [0251.893] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\", lpFilePart=0x0) returned 0x48 [0251.893] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0251.893] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.893] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.893] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.893] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.894] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.894] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.894] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0251.894] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0251.894] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0251.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0251.894] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0251.894] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", lpFilePart=0x0) returned 0x50 [0251.894] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", dwFileAttributes=0x80) returned 1 [0251.896] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x58 [0251.896] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0251.896] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0251.897] GetFileType (hFile=0x15c) returned 0x1 [0251.897] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0251.897] GetFileType (hFile=0x15c) returned 0x1 [0252.471] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", lpFilePart=0x0) returned 0x50 [0252.471] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0252.471] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0252.472] GetFileType (hFile=0x23c) returned 0x1 [0252.472] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0252.472] GetFileType (hFile=0x23c) returned 0x1 [0252.472] ReadFile (in: hFile=0x23c, lpBuffer=0x227fb58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x227fb58*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0252.477] ReadFile (in: hFile=0x23c, lpBuffer=0x227fb58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x227fb58*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0252.477] ReadFile (in: hFile=0x23c, lpBuffer=0x227fb58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x227fb58*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0252.477] ReadFile (in: hFile=0x23c, lpBuffer=0x227fb58, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x227fb58*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0252.478] CloseHandle (hObject=0x23c) returned 1 [0252.478] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", lpFilePart=0x0) returned 0x50 [0252.478] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.png")) returned 1 [0252.480] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0252.480] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0252.480] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0252.480] GetFileType (hFile=0x15c) returned 0x1 [0252.480] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0252.480] GetFileType (hFile=0x15c) returned 0x1 [0252.481] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png", lpFilePart=0x0) returned 0x50 [0252.481] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0252.481] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0252.482] GetFileType (hFile=0x15c) returned 0x1 [0252.482] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0252.482] GetFileType (hFile=0x15c) returned 0x1 [0252.482] WriteFile (in: hFile=0x15c, lpBuffer=0x228d580*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x228d580*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0252.483] CloseHandle (hObject=0x15c) returned 1 [0252.483] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0252.483] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0252.483] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0252.483] GetFileType (hFile=0x15c) returned 0x1 [0252.483] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0252.483] GetFileType (hFile=0x15c) returned 0x1 [0252.484] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0252.484] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0252.484] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0252.484] GetFileType (hFile=0x15c) returned 0x1 [0252.484] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0252.484] GetFileType (hFile=0x15c) returned 0x1 [0252.485] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0252.485] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x52 [0252.485] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0252.485] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.486] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0252.486] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0252.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0252.486] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0252.486] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0252.486] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030", lpFilePart=0x0) returned 0x52 [0252.487] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\", lpFilePart=0x0) returned 0x53 [0252.487] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0252.487] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.487] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.487] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.487] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.487] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.487] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0252.488] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0252.488] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0252.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0252.488] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0252.488] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0252.488] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", dwFileAttributes=0x80) returned 1 [0252.489] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0252.489] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0252.489] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0252.489] GetFileType (hFile=0x15c) returned 0x1 [0252.489] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0252.489] GetFileType (hFile=0x15c) returned 0x1 [0253.033] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0253.033] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0253.033] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0253.034] GetFileType (hFile=0x23c) returned 0x1 [0253.034] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0253.034] GetFileType (hFile=0x23c) returned 0x1 [0253.034] ReadFile (in: hFile=0x23c, lpBuffer=0x235b778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x235b778*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0253.039] ReadFile (in: hFile=0x23c, lpBuffer=0x235b778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x235b778*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0253.039] ReadFile (in: hFile=0x23c, lpBuffer=0x235b778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x235b778*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0253.039] ReadFile (in: hFile=0x23c, lpBuffer=0x235b778, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x235b778*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0253.039] CloseHandle (hObject=0x23c) returned 1 [0253.040] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0253.040] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.png")) returned 1 [0253.041] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0253.041] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0253.041] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0253.041] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0253.041] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.041] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.042] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.042] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.042] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.042] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.042] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0253.042] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0253.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0253.042] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0253.042] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0253.042] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages", lpFilePart=0x0) returned 0x5b [0253.042] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\", lpFilePart=0x0) returned 0x5c [0253.042] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0253.043] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0253.043] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0253.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0253.043] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0253.044] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0253.044] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0253.045] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0253.045] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0253.045] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0253.045] GetFileType (hFile=0x15c) returned 0x1 [0253.045] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0253.045] GetFileType (hFile=0x15c) returned 0x1 [0253.562] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0253.562] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0253.562] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0253.562] GetFileType (hFile=0x23c) returned 0x1 [0253.562] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0253.562] GetFileType (hFile=0x23c) returned 0x1 [0253.562] ReadFile (in: hFile=0x23c, lpBuffer=0x224b348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x224b348*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0253.566] ReadFile (in: hFile=0x23c, lpBuffer=0x224b348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x224b348*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0253.567] ReadFile (in: hFile=0x23c, lpBuffer=0x224b348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x224b348*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0253.567] ReadFile (in: hFile=0x23c, lpBuffer=0x224b348, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x224b348*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0253.568] CloseHandle (hObject=0x23c) returned 1 [0253.568] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0253.568] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.png")) returned 1 [0253.569] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0253.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72 [0253.569] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73 [0253.569] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.570] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0253.570] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0253.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0253.570] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0253.571] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0253.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64", lpFilePart=0x0) returned 0x72 [0253.571] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\", lpFilePart=0x0) returned 0x73 [0253.571] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0253.571] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.571] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.571] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.571] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.571] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.572] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.572] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0253.572] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0253.572] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0253.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0253.572] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0253.572] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0253.572] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", dwFileAttributes=0x80) returned 1 [0253.573] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x83 [0253.573] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0253.573] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0253.574] GetFileType (hFile=0x15c) returned 0x1 [0253.574] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0253.574] GetFileType (hFile=0x15c) returned 0x1 [0254.097] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0254.097] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0254.097] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0254.097] GetFileType (hFile=0x23c) returned 0x1 [0254.097] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0254.097] GetFileType (hFile=0x23c) returned 0x1 [0254.098] ReadFile (in: hFile=0x23c, lpBuffer=0x233bf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x233bf38*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0254.103] ReadFile (in: hFile=0x23c, lpBuffer=0x233bf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x233bf38*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0254.103] ReadFile (in: hFile=0x23c, lpBuffer=0x233bf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x233bf38*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0254.104] ReadFile (in: hFile=0x23c, lpBuffer=0x233bf38, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x233bf38*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0254.104] CloseHandle (hObject=0x23c) returned 1 [0254.104] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0254.104] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.png")) returned 1 [0254.107] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7b [0254.107] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0254.108] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.108] GetFileType (hFile=0x15c) returned 0x1 [0254.108] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0254.108] GetFileType (hFile=0x15c) returned 0x1 [0254.109] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png", lpFilePart=0x0) returned 0x7b [0254.109] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0254.109] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0254.110] GetFileType (hFile=0x15c) returned 0x1 [0254.110] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0254.110] GetFileType (hFile=0x15c) returned 0x1 [0254.110] WriteFile (in: hFile=0x15c, lpBuffer=0x2349a78*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x2349a78*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0254.111] CloseHandle (hObject=0x15c) returned 1 [0254.111] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7b [0254.111] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0254.111] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.111] GetFileType (hFile=0x15c) returned 0x1 [0254.111] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0254.111] GetFileType (hFile=0x15c) returned 0x1 [0254.112] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xa7 [0254.112] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0254.112] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.112] GetFileType (hFile=0x15c) returned 0x1 [0254.112] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0254.112] GetFileType (hFile=0x15c) returned 0x1 [0254.113] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x64 [0254.113] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0254.113] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.114] GetFileType (hFile=0x15c) returned 0x1 [0254.114] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0254.114] GetFileType (hFile=0x15c) returned 0x1 [0254.114] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0254.114] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0254.115] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0254.115] GetFileType (hFile=0x15c) returned 0x1 [0254.115] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0254.115] GetFileType (hFile=0x15c) returned 0x1 [0254.115] WriteFile (in: hFile=0x15c, lpBuffer=0x235b6e0*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x235b6e0*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0254.116] CloseHandle (hObject=0x15c) returned 1 [0254.116] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x64 [0254.116] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0254.116] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.116] GetFileType (hFile=0x15c) returned 0x1 [0254.116] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0254.116] GetFileType (hFile=0x15c) returned 0x1 [0254.117] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x90 [0254.117] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0254.117] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.117] GetFileType (hFile=0x15c) returned 0x1 [0254.118] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0254.118] GetFileType (hFile=0x15c) returned 0x1 [0254.118] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.TXT", lpFilePart=0x0) returned 0x5b [0254.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0254.118] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.119] GetFileType (hFile=0x15c) returned 0x1 [0254.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0254.119] GetFileType (hFile=0x15c) returned 0x1 [0254.119] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png", lpFilePart=0x0) returned 0x5b [0254.120] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0254.120] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0254.120] GetFileType (hFile=0x15c) returned 0x1 [0254.120] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0254.120] GetFileType (hFile=0x15c) returned 0x1 [0254.120] WriteFile (in: hFile=0x15c, lpBuffer=0x236d238*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x236d238*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0254.121] CloseHandle (hObject=0x15c) returned 1 [0254.121] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.vbs", lpFilePart=0x0) returned 0x5b [0254.121] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0254.121] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.121] GetFileType (hFile=0x15c) returned 0x1 [0254.121] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0254.121] GetFileType (hFile=0x15c) returned 0x1 [0254.122] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x87 [0254.122] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0254.123] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0254.123] GetFileType (hFile=0x15c) returned 0x1 [0254.123] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0254.123] GetFileType (hFile=0x15c) returned 0x1 [0254.124] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0254.124] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x53 [0254.124] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0254.124] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0254.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.124] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.125] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.125] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0254.125] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0254.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0254.125] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0254.125] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0254.125] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017", lpFilePart=0x0) returned 0x53 [0254.125] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\", lpFilePart=0x0) returned 0x54 [0254.125] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0254.125] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.125] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.125] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.126] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.126] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.126] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0254.126] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0254.126] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0254.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0254.126] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0254.126] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0254.126] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", dwFileAttributes=0x80) returned 1 [0254.127] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x64 [0254.127] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0254.127] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0254.128] GetFileType (hFile=0x15c) returned 0x1 [0254.128] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0254.128] GetFileType (hFile=0x15c) returned 0x1 [0254.604] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0254.604] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0254.604] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0254.605] GetFileType (hFile=0x23c) returned 0x1 [0254.605] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0254.605] GetFileType (hFile=0x23c) returned 0x1 [0254.605] ReadFile (in: hFile=0x23c, lpBuffer=0x2260a90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2260a90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0254.608] ReadFile (in: hFile=0x23c, lpBuffer=0x2260a90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2260a90*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0254.610] ReadFile (in: hFile=0x23c, lpBuffer=0x2260a90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2260a90*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0254.610] ReadFile (in: hFile=0x23c, lpBuffer=0x2260a90, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2260a90*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0254.610] CloseHandle (hObject=0x23c) returned 1 [0254.611] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0254.611] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.png")) returned 1 [0254.612] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0254.612] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0254.612] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0254.612] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.613] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0254.614] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0254.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0254.614] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0254.614] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0254.614] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages", lpFilePart=0x0) returned 0x5c [0254.614] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\", lpFilePart=0x0) returned 0x5d [0254.614] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0254.614] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.614] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.614] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.614] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.615] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.615] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0254.615] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0254.615] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0254.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0254.615] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0254.615] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0254.615] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0254.616] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6d [0254.616] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0254.616] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0254.617] GetFileType (hFile=0x15c) returned 0x1 [0254.617] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0254.617] GetFileType (hFile=0x15c) returned 0x1 [0255.136] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0255.136] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0255.136] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0255.136] GetFileType (hFile=0x23c) returned 0x1 [0255.136] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0255.136] GetFileType (hFile=0x23c) returned 0x1 [0255.136] ReadFile (in: hFile=0x23c, lpBuffer=0x2350628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2350628*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0255.141] ReadFile (in: hFile=0x23c, lpBuffer=0x2350628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2350628*, lpNumberOfBytesRead=0x2ede68*=0x1000, lpOverlapped=0x0) returned 1 [0255.142] ReadFile (in: hFile=0x23c, lpBuffer=0x2350628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2350628*, lpNumberOfBytesRead=0x2ede68*=0x337, lpOverlapped=0x0) returned 1 [0255.142] ReadFile (in: hFile=0x23c, lpBuffer=0x2350628, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2ede68, lpOverlapped=0x0 | out: lpBuffer=0x2350628*, lpNumberOfBytesRead=0x2ede68*=0x0, lpOverlapped=0x0) returned 1 [0255.142] CloseHandle (hObject=0x23c) returned 1 [0255.142] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed960, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0255.142] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.png")) returned 1 [0255.143] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0255.143] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x76 [0255.143] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x77 [0255.144] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.144] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.145] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0255.145] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0255.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0255.145] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0255.145] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0255.145] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", nBufferLength=0x105, lpBuffer=0x2ed900, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64", lpFilePart=0x0) returned 0x76 [0255.145] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", nBufferLength=0x105, lpBuffer=0x2ed8a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\", lpFilePart=0x0) returned 0x77 [0255.145] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\*", lpFindFileData=0x2edab0 | out: lpFindFileData=0x2edab0) returned 0x1e406b0 [0255.145] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.145] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.145] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.146] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.146] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.146] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.146] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 1 [0255.146] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb00 | out: lpFindFileData=0x2edb00) returned 0 [0255.146] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0255.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd60) returned 1 [0255.146] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0255.146] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7f [0255.146] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", dwFileAttributes=0x80) returned 1 [0255.147] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x87 [0255.147] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0255.147] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0255.148] GetFileType (hFile=0x15c) returned 0x1 [0255.148] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0255.148] GetFileType (hFile=0x15c) returned 0x1 [0255.640] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed7d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7f [0255.641] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcb0) returned 1 [0255.641] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0255.641] GetFileType (hFile=0x23c) returned 0x1 [0255.641] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc20) returned 1 [0255.641] GetFileType (hFile=0x23c) returned 0x1 [0255.641] ReadFile (in: hFile=0x23c, lpBuffer=0x22414a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22414a0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0255.646] ReadFile (in: hFile=0x23c, lpBuffer=0x22414a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22414a0*, lpNumberOfBytesRead=0x2edde8*=0x1000, lpOverlapped=0x0) returned 1 [0255.646] ReadFile (in: hFile=0x23c, lpBuffer=0x22414a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22414a0*, lpNumberOfBytesRead=0x2edde8*=0x337, lpOverlapped=0x0) returned 1 [0255.647] ReadFile (in: hFile=0x23c, lpBuffer=0x22414a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edde8, lpOverlapped=0x0 | out: lpBuffer=0x22414a0*, lpNumberOfBytesRead=0x2edde8*=0x0, lpOverlapped=0x0) returned 1 [0255.647] CloseHandle (hObject=0x23c) returned 1 [0255.647] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7f [0255.647] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.png")) returned 1 [0255.649] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT", lpFilePart=0x0) returned 0x7f [0255.649] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0255.649] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.649] GetFileType (hFile=0x15c) returned 0x1 [0255.649] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0255.650] GetFileType (hFile=0x15c) returned 0x1 [0255.650] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed830, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png", lpFilePart=0x0) returned 0x7f [0255.650] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd10) returned 1 [0255.650] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0255.651] GetFileType (hFile=0x15c) returned 0x1 [0255.651] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc80) returned 1 [0255.651] GetFileType (hFile=0x15c) returned 0x1 [0255.651] WriteFile (in: hFile=0x15c, lpBuffer=0x224f000*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2ede38, lpOverlapped=0x0 | out: lpBuffer=0x224f000*, lpNumberOfBytesWritten=0x2ede38*=0x2337, lpOverlapped=0x0) returned 1 [0255.652] CloseHandle (hObject=0x15c) returned 1 [0255.652] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs", lpFilePart=0x0) returned 0x7f [0255.653] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0255.653] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.653] GetFileType (hFile=0x15c) returned 0x1 [0255.653] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0255.653] GetFileType (hFile=0x15c) returned 0x1 [0255.654] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed770, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0xab [0255.654] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edc50) returned 1 [0255.654] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.654] GetFileType (hFile=0x15c) returned 0x1 [0255.654] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edbc0) returned 1 [0255.654] GetFileType (hFile=0x15c) returned 0x1 [0255.655] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.TXT", lpFilePart=0x0) returned 0x65 [0255.655] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0255.655] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.655] GetFileType (hFile=0x15c) returned 0x1 [0255.655] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0255.655] GetFileType (hFile=0x15c) returned 0x1 [0255.656] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png", lpFilePart=0x0) returned 0x65 [0255.656] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd90) returned 1 [0255.656] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0255.657] GetFileType (hFile=0x15c) returned 0x1 [0255.657] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd00) returned 1 [0255.657] GetFileType (hFile=0x15c) returned 0x1 [0255.657] WriteFile (in: hFile=0x15c, lpBuffer=0x2260c90*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edeb8, lpOverlapped=0x0 | out: lpBuffer=0x2260c90*, lpNumberOfBytesWritten=0x2edeb8*=0x2337, lpOverlapped=0x0) returned 1 [0255.658] CloseHandle (hObject=0x15c) returned 1 [0255.658] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.vbs", lpFilePart=0x0) returned 0x65 [0255.658] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0255.658] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.658] GetFileType (hFile=0x15c) returned 0x1 [0255.658] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0255.659] GetFileType (hFile=0x15c) returned 0x1 [0255.659] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed7f0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x91 [0255.659] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edcd0) returned 1 [0255.659] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.660] GetFileType (hFile=0x15c) returned 0x1 [0255.660] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edc40) returned 1 [0255.660] GetFileType (hFile=0x15c) returned 0x1 [0255.660] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.TXT", lpFilePart=0x0) returned 0x5c [0255.660] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0255.661] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.661] GetFileType (hFile=0x15c) returned 0x1 [0255.661] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0255.661] GetFileType (hFile=0x15c) returned 0x1 [0255.662] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png", lpFilePart=0x0) returned 0x5c [0255.662] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0255.662] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0255.662] GetFileType (hFile=0x15c) returned 0x1 [0255.662] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0255.662] GetFileType (hFile=0x15c) returned 0x1 [0255.662] WriteFile (in: hFile=0x15c, lpBuffer=0x2272800*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2272800*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0255.663] CloseHandle (hObject=0x15c) returned 1 [0255.663] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.vbs", lpFilePart=0x0) returned 0x5c [0255.663] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0255.663] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.664] GetFileType (hFile=0x15c) returned 0x1 [0255.664] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0255.664] GetFileType (hFile=0x15c) returned 0x1 [0255.664] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x88 [0255.664] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0255.664] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0255.665] GetFileType (hFile=0x15c) returned 0x1 [0255.665] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0255.665] GetFileType (hFile=0x15c) returned 0x1 [0255.665] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0255.665] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47 [0255.666] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpFilePart=0x0) returned 0x48 [0255.666] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.666] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0255.667] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0255.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0255.667] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0255.667] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0255.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}", lpFilePart=0x0) returned 0x47 [0255.667] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\", lpFilePart=0x0) returned 0x48 [0255.667] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0255.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.667] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0255.668] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0255.668] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0255.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0255.668] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0255.668] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", lpFilePart=0x0) returned 0x50 [0255.668] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", dwFileAttributes=0x80) returned 1 [0255.669] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x58 [0255.669] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0255.669] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0255.670] GetFileType (hFile=0x15c) returned 0x1 [0255.670] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0255.670] GetFileType (hFile=0x15c) returned 0x1 [0256.195] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.195] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0256.195] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0256.196] GetFileType (hFile=0x23c) returned 0x1 [0256.196] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0256.196] GetFileType (hFile=0x23c) returned 0x1 [0256.196] ReadFile (in: hFile=0x23c, lpBuffer=0x2366028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2366028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0256.202] ReadFile (in: hFile=0x23c, lpBuffer=0x2366028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2366028*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0256.203] ReadFile (in: hFile=0x23c, lpBuffer=0x2366028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2366028*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0256.203] ReadFile (in: hFile=0x23c, lpBuffer=0x2366028, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2366028*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0256.203] CloseHandle (hObject=0x23c) returned 1 [0256.203] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.203] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.png")) returned 1 [0256.207] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0256.208] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0256.208] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0256.208] GetFileType (hFile=0x15c) returned 0x1 [0256.208] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0256.208] GetFileType (hFile=0x15c) returned 0x1 [0256.209] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.209] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0256.209] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0256.210] GetFileType (hFile=0x15c) returned 0x1 [0256.210] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0256.210] GetFileType (hFile=0x15c) returned 0x1 [0256.210] WriteFile (in: hFile=0x15c, lpBuffer=0x2373a50*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2373a50*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0256.211] CloseHandle (hObject=0x15c) returned 1 [0256.211] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0256.211] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0256.211] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0256.211] GetFileType (hFile=0x15c) returned 0x1 [0256.211] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0256.211] GetFileType (hFile=0x15c) returned 0x1 [0256.212] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0256.212] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0256.212] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{e52a6842-b0ac-476e-b48f-378a97a67346}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0256.213] GetFileType (hFile=0x15c) returned 0x1 [0256.213] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0256.213] GetFileType (hFile=0x15c) returned 0x1 [0256.214] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0256.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0256.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x48 [0256.214] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0256.214] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.214] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.214] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.215] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.215] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.215] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.215] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.215] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0256.215] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0256.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0256.215] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0256.215] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0256.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}", lpFilePart=0x0) returned 0x47 [0256.215] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\", lpFilePart=0x0) returned 0x48 [0256.216] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0256.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.216] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.217] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0256.217] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0256.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0256.217] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0256.217] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.217] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", dwFileAttributes=0x80) returned 1 [0256.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x58 [0256.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0256.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0256.219] GetFileType (hFile=0x15c) returned 0x1 [0256.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0256.219] GetFileType (hFile=0x15c) returned 0x1 [0256.716] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.717] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0256.717] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0256.717] GetFileType (hFile=0x23c) returned 0x1 [0256.717] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0256.717] GetFileType (hFile=0x23c) returned 0x1 [0256.717] ReadFile (in: hFile=0x23c, lpBuffer=0x22672a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22672a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0256.722] ReadFile (in: hFile=0x23c, lpBuffer=0x22672a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22672a0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0256.722] ReadFile (in: hFile=0x23c, lpBuffer=0x22672a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22672a0*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0256.722] ReadFile (in: hFile=0x23c, lpBuffer=0x22672a0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22672a0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0256.722] CloseHandle (hObject=0x23c) returned 1 [0256.723] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.723] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.png")) returned 1 [0256.726] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0256.726] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0256.726] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0256.727] GetFileType (hFile=0x15c) returned 0x1 [0256.727] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0256.727] GetFileType (hFile=0x15c) returned 0x1 [0256.727] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.727] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0256.727] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0256.728] GetFileType (hFile=0x15c) returned 0x1 [0256.728] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0256.728] GetFileType (hFile=0x15c) returned 0x1 [0256.728] WriteFile (in: hFile=0x15c, lpBuffer=0x2274cc8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2274cc8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0256.729] CloseHandle (hObject=0x15c) returned 1 [0256.729] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0256.729] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0256.730] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0256.730] GetFileType (hFile=0x15c) returned 0x1 [0256.730] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0256.730] GetFileType (hFile=0x15c) returned 0x1 [0256.731] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0256.731] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0256.731] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{e6e75766-da0f-4ba2-9788-6ea593ce702d}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0256.731] GetFileType (hFile=0x15c) returned 0x1 [0256.731] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0256.731] GetFileType (hFile=0x15c) returned 0x1 [0256.732] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0256.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0256.732] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x48 [0256.732] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0256.732] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.732] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.732] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.732] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0256.733] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0256.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0256.733] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0256.733] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0256.733] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}", lpFilePart=0x0) returned 0x47 [0256.733] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\", lpFilePart=0x0) returned 0x48 [0256.733] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0256.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.733] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0256.734] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0256.734] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0256.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0256.734] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0256.734] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0256.735] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", dwFileAttributes=0x80) returned 1 [0256.735] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x58 [0256.735] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0256.735] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0256.736] GetFileType (hFile=0x15c) returned 0x1 [0256.736] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0256.736] GetFileType (hFile=0x15c) returned 0x1 [0257.206] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0257.206] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0257.206] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0257.207] GetFileType (hFile=0x23c) returned 0x1 [0257.207] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0257.207] GetFileType (hFile=0x23c) returned 0x1 [0257.207] ReadFile (in: hFile=0x23c, lpBuffer=0x2368480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2368480*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0257.213] ReadFile (in: hFile=0x23c, lpBuffer=0x2368480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2368480*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0257.213] ReadFile (in: hFile=0x23c, lpBuffer=0x2368480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2368480*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0257.214] ReadFile (in: hFile=0x23c, lpBuffer=0x2368480, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x2368480*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0257.214] CloseHandle (hObject=0x23c) returned 1 [0257.214] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0257.214] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.png")) returned 1 [0257.218] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.TXT", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.TXT", lpFilePart=0x0) returned 0x50 [0257.218] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0257.218] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.TXT" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.txt"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0257.219] GetFileType (hFile=0x15c) returned 0x1 [0257.219] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0257.219] GetFileType (hFile=0x15c) returned 0x1 [0257.220] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed930, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png", lpFilePart=0x0) returned 0x50 [0257.220] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede10) returned 1 [0257.220] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.png"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0257.223] GetFileType (hFile=0x15c) returned 0x1 [0257.223] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd80) returned 1 [0257.223] GetFileType (hFile=0x15c) returned 0x1 [0257.223] WriteFile (in: hFile=0x15c, lpBuffer=0x2375ea8*, nNumberOfBytesToWrite=0x2337, lpNumberOfBytesWritten=0x2edf38, lpOverlapped=0x0 | out: lpBuffer=0x2375ea8*, lpNumberOfBytesWritten=0x2edf38*=0x2337, lpOverlapped=0x0) returned 1 [0257.224] CloseHandle (hObject=0x15c) returned 1 [0257.224] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.vbs", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.vbs", lpFilePart=0x0) returned 0x50 [0257.224] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0257.225] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\Hack.vbs" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\hack.vbs"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0257.225] GetFileType (hFile=0x15c) returned 0x1 [0257.225] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0257.225] GetFileType (hFile=0x15c) returned 0x1 [0257.226] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", nBufferLength=0x105, lpBuffer=0x2ed870, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information", lpFilePart=0x0) returned 0x7c [0257.226] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd50) returned 1 [0257.226] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\UniqueKEYFor5p5NrGJn0jS HALPmcxz.Horsuke.Information" (normalized: "c:\\users\\all users\\package cache\\{f325f05b-f963-4640-a43b-c8a494cdda0f}\\uniquekeyfor5p5nrgjn0js halpmcxz.horsuke.information"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x15c [0257.227] GetFileType (hFile=0x15c) returned 0x1 [0257.227] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edcc0) returned 1 [0257.227] GetFileType (hFile=0x15c) returned 0x1 [0257.228] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0257.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0257.228] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0257.228] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.229] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0257.230] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0257.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0257.230] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0257.230] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edf10) returned 1 [0257.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", nBufferLength=0x105, lpBuffer=0x2eda00, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005", lpFilePart=0x0) returned 0x52 [0257.230] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", nBufferLength=0x105, lpBuffer=0x2ed9a0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\", lpFilePart=0x0) returned 0x53 [0257.230] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\*", lpFindFileData=0x2edbb0 | out: lpFindFileData=0x2edbb0) returned 0x1e406b0 [0257.230] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.230] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.230] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 1 [0257.231] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edc00 | out: lpFindFileData=0x2edc00) returned 0 [0257.231] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0257.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede60) returned 1 [0257.231] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2ede20) returned 1 [0257.231] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2edab0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0257.231] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", dwFileAttributes=0x80) returned 1 [0257.232] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x63 [0257.233] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0257.233] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0257.233] GetFileType (hFile=0x15c) returned 0x1 [0257.233] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0257.233] GetFileType (hFile=0x15c) returned 0x1 [0257.779] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed8d0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0257.779] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2eddb0) returned 1 [0257.779] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x23c [0257.780] GetFileType (hFile=0x23c) returned 0x1 [0257.780] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edd20) returned 1 [0257.780] GetFileType (hFile=0x23c) returned 0x1 [0257.780] ReadFile (in: hFile=0x23c, lpBuffer=0x22695c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22695c0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0257.783] ReadFile (in: hFile=0x23c, lpBuffer=0x22695c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22695c0*, lpNumberOfBytesRead=0x2edee8*=0x1000, lpOverlapped=0x0) returned 1 [0257.785] ReadFile (in: hFile=0x23c, lpBuffer=0x22695c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22695c0*, lpNumberOfBytesRead=0x2edee8*=0x337, lpOverlapped=0x0) returned 1 [0257.785] ReadFile (in: hFile=0x23c, lpBuffer=0x22695c0, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x2edee8, lpOverlapped=0x0 | out: lpBuffer=0x22695c0*, lpNumberOfBytesRead=0x2edee8*=0x0, lpOverlapped=0x0) returned 1 [0257.786] CloseHandle (hObject=0x23c) returned 1 [0257.786] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", nBufferLength=0x105, lpBuffer=0x2ed9e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png", lpFilePart=0x0) returned 0x5b [0257.786] DeleteFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\Hack.png" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\hack.png")) returned 1 [0257.787] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0257.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0257.787] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0257.787] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0257.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.787] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.788] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0257.788] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0257.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0257.788] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0257.788] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2ede90) returned 1 [0257.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", nBufferLength=0x105, lpBuffer=0x2ed980, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages", lpFilePart=0x0) returned 0x5b [0257.788] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", nBufferLength=0x105, lpBuffer=0x2ed920, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\", lpFilePart=0x0) returned 0x5c [0257.788] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\*", lpFindFileData=0x2edb30 | out: lpFindFileData=0x2edb30) returned 0x1e406b0 [0257.789] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.789] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.789] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.789] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.789] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.789] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 1 [0257.790] FindNextFileW (in: hFindFile=0x1e406b0, lpFindFileData=0x2edb80 | out: lpFindFileData=0x2edb80) returned 0 [0257.790] FindClose (in: hFindFile=0x1e406b0 | out: hFindFile=0x1e406b0) returned 1 [0257.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edde0) returned 1 [0257.790] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edda0) returned 1 [0257.790] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.png", nBufferLength=0x105, lpBuffer=0x2eda30, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.png", lpFilePart=0x0) returned 0x64 [0257.790] SetFileAttributesW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.png", dwFileAttributes=0x80) returned 1 [0257.791] GetFullPathNameW (in: lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.png.Horsuke", nBufferLength=0x105, lpBuffer=0x2ed850, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.png.Horsuke", lpFilePart=0x0) returned 0x6c [0257.791] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x2edd30) returned 1 [0257.791] CreateFileW (lpFileName="C:\\Users\\All Users\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\Hack.png.Horsuke" (normalized: "c:\\users\\all users\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\hack.png.horsuke"), dwDesiredAccess=0xc0000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x15c [0257.791] GetFileType (hFile=0x15c) returned 0x1 [0257.791] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x2edca0) returned 1 [0257.791] GetFileType (hFile=0x15c) returned 0x1 Thread: id = 2 os_tid = 0x520 Thread: id = 3 os_tid = 0x478 [0021.779] CoGetContextToken (in: pToken=0x1a88f720 | out: pToken=0x1a88f720) returned 0x800401f0 [0021.779] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0 [0113.297] WriteFile (in: hFile=0x228, lpBuffer=0x2222958*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x1a88f508, lpOverlapped=0x0 | out: lpBuffer=0x2222958*, lpNumberOfBytesWritten=0x1a88f508*=0x20, lpOverlapped=0x0) returned 1 [0113.298] CloseHandle (hObject=0x228) returned 1 Thread: id = 4 os_tid = 0x77c Thread: id = 5 os_tid = 0x674 Thread: id = 6 os_tid = 0x6a0 Thread: id = 7 os_tid = 0x2ac Thread: id = 8 os_tid = 0x440